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Abstract 



Recently, the field of unconventional computing has witnessed a huge research effort to solve 
the problem of the assumed power of computers operating purely according to the laws of 
quantum physics. Quantum computing can be seen as a special intermediate case between 
digital and real analog computing. Importantly, there is a threshold theorem for error correc- 
tion, as opposed to the pure analog case. Alternatively, quantum computing can be viewed as 
generalized probabilistic computing, where non-negative real probabilities are replaced with 
complex amplitudes. The main new resources are quantum mechanical phenomena such as 
state superposition, interference and entanglement. Superposition together with interference 
provide a special kind of parallelism, while entanglement, especially when spatially shared, 
supports unique means of communication. 

One of the most important theoretical result is a proof by Bernstein and Vazirani (1993) that 
there is an oracle relative to which there is a language that can be efficiently accepted by a 
quantum Turing machine, but cannot be efficiently accepted by a bounded-error probabilistic 
Turing machine. The problem which was considered is called Recursive Fourier Sampling and 
the proposed quantum algorithm gives a quasipolynomial speedup, 0(n) versus 0(n^°§"). 
Next, Abrams and Lloyd showed that a quantum computer can efficiently simulate many- 
body quantum systems having a local Hamiltonian. An additional (informal) evidence of 
the assumed power of a quantum computer is a bounded-error quantum polynomial time 
algorithm for large integer factoring. The Abrams-Lloyd algorithm is potentially the most 
useful quantum algorithm known so far, and if a quantum computer is ever built, it will 
revolutionize quantum chemical calculations. Thus there is a growing consensus regarding 
investments into the experimental quantum computing. 

In this thesis, attention is paid to small experimental testbed applications with respect to 
the quantum phase estimation algorithm, the core approach for finding energy eigenvalues. 
An iterative scheme for quantum phase estimation (IPEA) is derived from the Kitaev phase 
estimation, a study of robustness of the IPEA utilized as a few-qubit testbed application is 
performed, and an improved protocol for phase reference alignment is presented. Additionally, 
a short overview of quantum cryptography is given, with a particular focus on quantum 
steganography and authentication. 

The work was supported by SSF Nanodev Consortium, by the European Commission through 
the IST-015708 EuroSQIP project and by the Czech Technical University through the grant 
CTU0507213. 

Keywords: quantum computing, quantum phase estimation, iterative quantum protocols, 
quantum cryptography, quantum steganography 
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Chapter 1 

Introduction 



1.1 Computation and information processing 

Computation and information processing in general always played an important role in human 
society. We can find mechanical devices performing computation in ancient astronomy, the 
Greek Antikythera mechanism (150 BCE) is the oldest known mechanical analog computer, 
we can see basic information processing such as storing data in a written form on the walls 
of Egyptian pyramids. Somewhat more advanced information processing in a modern sense 
is historically connected to solving equations. Arabic mathematician Muhammad ben Musa 
al-Khwarizmi (825 CE) seems to be the first who used a concept of repeatedly applying a set 
of reduction rules in order to reduce the complexity of the equation at hand. The reduction 
(al-jebr) later gave name to the algebra and the concept itself is now called an algorithm in 
honor of al-Khwarizmi. 

Later on, advances in math and technology gave birth to the question of which prob- 
lems/functions in principle can be calculated, and to which extent can a mechanical device 
(a machine) support an automatic problem reduction according to a given algorithm. These 
questions date back to Gottfried Leibnitz (1646 - 1716) who after having successfully con- 
structed a mechanical calculating device dreamt of a formal language for a machine that could 
manipulate symbols and determine the truth values of mathematical statements. 

In 1936, Alan Turing developed an abstract notation of a programmable universal computer, 
a Turing machine, in order to address Hilbert's Entscheidunsgproblem (German for 'decision 
problem'). Using this abstraction, he was able to prove that there is no mechanical procedure 
which can be used to decide arbitrary statements in mathematics. In particular, Turing 
reduced the halting problem to the Entscheidunsgproblem. The term 'mechanical procedure' 
does not directly refer to digital or analog implementation, however, classical mechanics was 
assumed implicitly. 

Also Turing's result directly spawns a short proof of Godel Incompleteness Theorem, which 
is otherwise very long. In modern terms, the original Godel's proof (1931) consists mainly of 
defining a sort of computational model (a Godel numbering) and the work of Turing is heavily 
influenced by that. A few months before Turing's result, Alonzo Church (adviser of Turing) 
finished his work on lambda calculus and proved that any function of positive integers can be 
mechanically computed only if it is recursive. Soon it turned out that lambda calculus and 
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Turing machine abstraction are equivalent (so are all new non-hypercomputation proposals) 
and the authors formulated the Church- Turing hypothesis: 



'Any function "naturally to be regarded as computable" is computable by a Turing 

m,achine '. 



The Church-Turing hypothesis cannot be mathematically proven and therefore it is sometimes 
proposed as a definition or as a physical law using a modern reformulation by David Deutsch 
(1985): 



'Every finitely realizable physical system can be perfectly simulated by a universal 
model computing machine operating by finite means'. 



A few years later, after Church and Turing's theoretical breakthrough, the use of digital elec- 
tronics largely invented by Claude Shannon and the stored program architecture proposed by 
John von Neumann gave birth to the first real-life computing devices with all the capabilities 
of a Turing machine. The discovery of the transistor led to a rapid progress in technology 
and the digital computer era started. 

It may be surprising that while previous computing devices were analog ones (based on me- 
chanical or hydraulic principles) , electronic analog computers were beaten by electronic digital 
computers. The reasons are purely technical. Practical computing with analog electronics is 
limited by the range over which the variables might vary, and, moreover, there is no theorem 
saying that noise can ever be efficiently suppressed. Today, electronic analog computing is 
still studied in the field of artificial neural networks with limited precision real weights. The 
main point is that some problems map more naturally to an analog computer than to a digital 
computer and therefore the computation might be faster due to reduced mapping costs. 

It is worth to mention here, that an analog computer does not implicitly assume a scale- 
independent continuous phenomenon for a practical computation. In fact, a hypothetical de- 
vice using real numbers with infinite precision which are harnessable for computation would 
allow for non-Turing (non-recursive) functions to be computed. This is called a hypercompu- 
tation. A hypercomputer would not only violate the Church- Turing hypothesis, but it would 
need to exploit a real continuous phenomenon, which we know is largely ruled out by quantum 
physics. The difference between digital computing and real analog computing might also be 
seen as the difference between computable numbers and algebraic systems vs. real numbers 
and differential systems. 

On the theoretical ground, it was found that it is valuable to classify algorithms and their 
complexity according to time and space demands with respect to the size of the input. Several 
prominent complexity classes refer to problems which are solvable by a Turing machine in 
polynomial time, P, problems solvable in polynomial space, PSPACE, problems solvable 

in exponential time, EXP, and problems for which, if the answer is 'y^s', then there is a 
polynomial time proof, NP. It follows that P C NP C PSPACE C EXP. 

The empirical practice reveals that the vast majority of important problems with polynomial 
time/space demands have their complexity bounded by polynomials of low degree, while 
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problems with exponential time demands have the base not close to one. It seems there is 
a sharp difference among problems contained in NP, fast efficiently solvable problems on 
one hand and practically intractable problems on the other one. The contrast of O(n^) and 
0(2") for n > 100 is overwhelming and therefore the structure of the NP class is of utmost 
importance. 

In the early 1970's, Cook, Karp and Levin proved an existence of A^P-complete problems, 
a subset of problems in NP, that are at least as difficult as any other problems in NP, 
and they actually showed that the decision version of many practical problems such as the 
Boolean satisfiability problem, the Traveling salesperson problem or the Clique problem are 
A^P-complete. So far, we have no indication that A^P-complete problems can be solved in 
polynomial time instead of exponential time on a Turing machine, and yet we are not able 
to prove or disprove the relation P ^ NP. Currently, the P ^ NP relation is one of the six 
Millennium Prize Problems established by the Clay Mathematics Institute. 

Clearly, we know problems contained in NP for which we did not find a polynomial runtime 
algorithm nor we proved them to be A^P-complete. This is partly due to our lack of knowledge, 
and, moreover, if P 7^ NP, then the Ladner's Theorem (1975) says that there must be 
intermediate problems between P and A?^P-complete. Next to several artificial problems 
developed just for the purpose of being iVP-intermediate, natural problems such as primality 
testing, factoring of large integers and graph isomorphism were on the list together until 
recently. 

Probabilistic computing 

It was always considered that relaxing from deterministic computing to probabilistic com- 
puting might have a positive impact on problems solving. This expectation is connected to 
relatively fast converging iterative processes which when supplied with a 'right' guess do pro- 
duce the correct answer most of the time. The right guess is given by empirical sampling over 
similar cases. In this view, the art of designing a probabilistic algorithm consists of replacing 
a right guess by a random guess while keeping the convergence of the process. Probabilistic 
algorithms that always return the correct answer within an expected (finite) runtime is called 
a Las Vegas simulation. If the expected runtime is bounded by a polynomial we talk about a 
zero-error probabilistic polynomial-time problems, class ZPP. With a modification to stop 
after a certain number of steps and output an approximate (possibly false) result we get a 
Monte Carlo simulation. If the error probability can be bounded and polynomial-runtime is 
kept the corresponding class is BPP. The most general class of probabilistic polynomial time 
problems is PP. It follows that P C ZPP C BPP C PP C PSPACE. 

Advances in complexity theory and probabilistic algorithms led to so called Extended or 
Strong Church-Turing hypothesis due to Bernstein and Vazirani (1993): 



'Any "reasonable" model of computation can be efficiently simulated on a probabilistic 

Turing machine' 



The message of this hypothesis is three- fold. First, it is practically oriented. It refers to 
reasonable models of computation in order to stand aside from hypothetical hypercomputers 
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and classical extremely massive parallel systems where the space and/or energy requirements 
grow exponentially with the size of the input. An example of such model is the original 
Adleman DNA computer proposal (1994). Secondly, it allows a Turing machine to access 
a random number generator. This expresses the assumption that probabilistic algorithms 
might be stronger than deterministic ones. This assumption was supported mainly by a 
very fast probabilistic primality testing while deterministic testing needed exponential time. 
Third, the word 'efficiently' means that all reasonable computational devices regardless of 
their physical implementation are equivalent up to polynomial-time reductions. In other 
words, a problem classification is independent of machines while it is true that an architecture 
reflecting the inner structure of the problem may yield a polynomial speed-up compared to 
other architectures. 

One puzzling problem is the question of where the power of probabilistic algorithms comes 
from. Practice reveals that pseudo-random number generators are sufficient for most proba- 
bilistic algorithms in order to be successful. Additionally, classical mechanics which is still the 
main framework for computational theory does not allow for true random number generators. 
In fact, only practically unpredictable numbers can be generated. For this reason it is now 
believed that P might be equal to BPP. 

The assumption P = BPP started a study branch called 'derandomization'. The random 
essence is at first reduced to a one call of a random number generator, and then replaced by a 
deterministic process. In 2002, one remarkable success of derandomization was a deterministic 
polynomial-time primality testing algorithm (the AKS test) developed by Agrawal, Kayal and 
Saxena. Primality testing nicely reflects advances in theoretical computer science. In 1975, 
the test was shown to be in NP, later in 1992, it feh to ZPP, and in 2002, it went to P. The 
AKS primality test is however much slower than the probabilistic one and therefore it is used 
only as a part of mathematical proofs. 

This approach reflects problem solving in practice. Problem classification alone is sometime 
not the right figure of merit for its practical tractability. It only considers worst-case times, 
i.e. it gives us information that the problem never grows faster than a certain upper bound. 
In fact, relaxation to average cases (application specific) can reveal nice inner structure which 
allows for practically fast heuristics, random sampling, evolution techniques and so on. These 
methods are often of advantage in general. 

Some P and A^P- intermediate problems let alone A^P-complete ones, do not show enough 
structure which can be exploited for practical speed-up on average. On the other hand they 
seem to naturally map on unconventional computing devices such as biological, chemical 
and quantum systems. Actually, these problems are usually problems from their respective 
fields. This mirrors the fact that information processing is always a physical process and some 
processes in their natural form are faster compared to others. In the future, we might end up 
with a computer equipped with several co-processors which operate by different means than 
digital electronics. Another tantalizing prospect related to unconventional computers is that 
they might exhibit even faster than polynomial speed-up for specific problems and thus be 
a threat to the Strong Church- Turing hypothesis. The most serious candidate that appears 
not to obey the Strong Church- Turing hypothesis is a yet to be built quantum computer. 

Figure |1.1| summarizes currently known key points in the structure of decision problems and 
indicates the assumed power of quantum computers. PTM stands for a probabilistic Turing 
machine. 
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Quantum computing 

Classical information processing is developed in the framework of classical mechanics. Since 
classical physics was superseded by quantum physics in many ways, it is natural to explore 
the potential of information processing in the framework of quantum mechanics. In 1982, 
Richard P. Feynman conjectured that quantum physics in general can be simulated on a 
probabilistic Turing machine only with an exponential slowdown and speculated about a 
universal quantum mechanical system capable of an efficient simulation. At about the same 
time, it was proved by Bennett, Fredkin and Toffoli that a universal computation can be done 
reversibly. This was an important step since processes in quantum physics are reversible. An 
abstract model for quantum computing, a quantum Turing machine, was created by David 
Deutsch (1985) as a tool for constructing a test of the many- world interpretation of quantum 
physics. Quaintly enough, the test now hinges on the; question whether quantum information 
processing allows for strong artificial intelligence. The resemblance to the work of Turing is 
striking. They both developed an abstract toolkit with a great theoretical value on its own 
for further reasoning, and the reasoning at the end concerns artificial intelligence. Theoretical 
quantum information processing seems to have good prospects for deeper understanding of 
connections between computation, nature and life. 

States in a classical computer are represented as strings from a finite alphabet, typically 
binary strings, while states of a quantum computer are represented by unit vectors in a fi- 
nite dimensional complex Hilbert space. Complex amplitudes of these vectors are allowed 
to change continuously, but they cannot be directly observed. Therefore quantum comput- 
ing can be seen as a special intermediate case between digital and real analog computing. 
Importantly, there is a threshold theorem for quantum error correction, as opposed to the 
pure analog case. Alternatively, quantum computing can be seen as generalized probabilistic 
computing, where non-negative real probabilities are replaced with complex amplitudes. The 
main new resources arc quantum mechanical phenomena such as state superposition, inter- 
ference and entanglement. Superposition together with interference provide a special kind of 
parallelism, while entanglement, especially when spatially shared, supports unique means of 
communication. 

The first evidence (promise problems) of the assumed quantum computer power was given by 
D. Deutsch (1985), Deutsch and Jozsa (1992), Bernstein and Vazirani (1993), and D. Simon 
(1994). Although these promise problems concerning global properties of functions were 
somewhat artificial, the corresponding quantum circuits composed from a set of universal gates 
gave an exponential speed-up over the classical deterministic solutions. In 1994, Peter W. 
Shor published a bounded-error quantum polynomial time algorithm for large integer factoring 
and discrete logarithm calculations. The corresponding complexity class is called BQP. The 
factoring problem is believed to be classically intractable and currently the RSA public-key 
cryptosystem is based on its intractability. Later in 1999, Abrams and Lloyd described a 
BQP algorithm for finding energy eigenvalues and eigenvectors of quantum physical systems 
governed by a local Hamiltonian. Again, this is exponentially faster than many ab initio 
methods now used in physics and chemistry problems where local Hamiltonian takes place. 
It turned out that all of the above mentioned problems are instances of a hidden subgroup 
problem (HSP) over Abelian groups, and the problem-solution approach can be explained in 
terms of the quantum phase estimation algorithm (PEA). A key ingredient in this algorithm 
is a quantum Fourier transform (QFT) for which we actually know a quadratic size circuit 
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in the case of Abelian groups. Efficient solution for the HSP over non-Abehan groups is an 
open problem. It is known that an efficient circuit for the HSP over the symmetric group 
would lead to an efficient algorithm for the graph isomorphism problem. The HSP over the 
dihedral group is in the same manner connected to the shortest vector in a lattice problem. 
Recently, there has been progress in solving certain non-Abclian HSP utilizing transforms 
beyond QFT. A discovery of an efficient circuit for the Clebsch-Gordan transform over the 
Heisenberg group led to an efficient solution for the HSP over the Heisenberg group. The 
Clebsch-Gordan transform also led to a discovery of an efficient circuit for the Schur transform 
which might possibly open up for new quantum algorithms. 

The question whether a quantum computer can solve efficiently A^P-complctc problems re- 
mains to be answered as well as for a classical computer. In 1996, L. Grover presented a 
sort of no-go for quantum exponential speed-up for completely unstructured problems. He 
developed an algorithm for unsorted database search which is provably optimal and yields 
only a square root speed-up. In particular, a desired item from an unsorted database of size 
N can be searched in time 0{\fN). 

From the practical realization point of view, there is no known viable technology for a scal- 
able quantum computer yet. Experiments have been performed with up to ten quantum bits. 
Problems are caused mainly due to environmental noise. Other problems arise from entan- 
glement which makes the border line between a central processing unit and memory not that 
sharp as it is in a classical computer. One possible approach toward solving this problem is 
a distributed quantum computer. Here, relatively easy to stabilize small cores are intercon- 
nected with quantum and classical channels, and by exploiting quantum state teleportation 
and non-local control they cooperate on the problem solving. 

Besides quantum computing, there is also a discipline called quantum cryptography. The 
protocol BB84 developed by Bennett and Brassard in 1984 solves the problem of secret- 
key distribution in an unconditionally secure way. This is assured for free by the quantum 
physics laws themselves. The first commercial products with the BB84 are already available. 
They work as point-to-point systems over a fiber optic line, up to 100km of length, at rates 
approximately lOOkbits/sec. Another commercially available product in the form of a stan- 
dard PCI card or an USB device is a quantum random number generator. The bit rate is 
over 16Mbits/sec. In general, special properties of a quantum physical system such as the 
no-cloning property of an unknown quantum state and the randomness in a wave function 
collapse allow for many quantum enhanced cryptographic primitives. These primitives range 
from authentication to covered communication (steganography) and more. 



1.2 Motivation and contribution of the thesis 

The Abrams-Lloyd algorithm for finding energy eigenvalues is potentially the most useful 
quantum algorithm known so far, and if a quantum computer is ever built, it will revolutionize 
quantum chemical calculations. Thus there is a growing consensus regarding investments into 
the experimental quantum computing. 

In this thesis, attention is paid to small experimental testbed applications with respect to 
the quantum phase estimation algorithm, the core approach for finding energy eigenvalues. 
An iterative scheme for quantum phase estimation (IPEA) is derived from the Kitaev phase 
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estimation, a study of robustness of the IPEA utilized as a few-qubit testbed application is 
performed, and an improved protocol for phase reference alignment is presented. The deriva- 
tion of the IPEA involves incorporating a classical postprocessing algorithm into a quantum 
circuit. The resulting quantum circuit then becomes more cfRcicnt. Such a result may be 
quite inspiring in the further development of quantum algorithms as the usual approach is to 
perform as much as possible of necessary calculations classically, since quantum resources are 
considered 'expensive'. 

Additionally, a short overview of a quantum cryptography is given, with a particular focus 
on quantum steganography and authentication. 

1.3 Organization of the thesis 

The outline of this thesis is as follows. Chapter 2 defines the terms used in the thesis. A 
rather large part of this chapter pertains to Turing machines and portions of linear algebra. 
Chapter 3 provides a summary on quantum computing and introduces the quantum Turing 
machine and quantum circuit model. A special attention is paid to the thin borderline between 
quantum computing and classical computing. Chapter 4 considers fast quantum algorithms, 
quantum phase estimation and its iterative variants, and a few testbed circuits. This is 
the main chapter of the thesis. Chapter 5 contains the overview on quantum cryptography. 
Finally, Chapter 6 consists of conclusions and the direction for future work. 



Chapter 2 

Basic definitions and postulates 



2.1 Turing machines 

A Turing machine is a symbol-manipulating device equipped with a read/ write head and 
possibly infinite cell-divided tape. The head reads the current symbol on the tape, changes its 
internal state accordingly, writes an output symbol if any, and then moves to the neighboring 
left or right cell. A computation consists of periodical repeating of these steps. At any 
moment, the computation is completely described by a Turing machine configuration. 

Definition 2.1.1 (Turing machine configuration). A configuration of a Turing machine is an 
ordered triple: 

• the contents of the tape, 

• the current state, 

• the position of the head. □ 

Despite the simplicity, the Church- Turing hypothesis says that a Turing machine can simulate 
the logic of any computer that could be possibly constructed. A Turing machine is said to be 
universal if it is able to simulate any other Turing machine. The smallest universal Turing 
machine has three symbols and two internal states p]. No smaller universal Turing machine 
is possible. Other commonly used computational abstractions are a cellular automata and a 
gate model. Gates sets such as {NAND, fanout}, {NOR, fanout}, {AND, NOT} constitute 
universal sets. The TofFoli gate alone is a universal gate for reversible computing. Formally, 
a Turing machine is defined as follows. 

Definition 2.1.2 (Turing machine). A Turing machine is an ordered six-tuple M = 
{Q,T.,b,qo,F,6), where 

1. Q is a finite set of states, 

2. S is a finite set of tape symbols (alphabet), 

3. 6 G S is the blank symbol. 
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4. qo ^ Q is the initial state, 

5. F C Q is the set of final or accepting states, 

6. 6: TixQ^TixQx {L, R} is a transition function, where L is shift left, R is shift 
right. 

The transition function 

6 : (current symbol, current state) — > (output symbol, new state, shift left/right) 
is usually given as an action table or a diagram. Sometimes it is written as 

6 : (current symbol, current state, output symbol, new state, shift left/right) — > {0, 1} 
in order to denote allowed transitions among configurations. 

Example 1 (Turing machine action table). A simple action table for a machine 

M=i{qo,quq2,qf}, {'0','1',6}, b, qo, {qj}, 6) 



calculating the XOR function over input bits a and b is shown in the Figure 2.1 The result 
is stored at the place of the second input bit. 



a 


b 


XOR 














1 


1 


1 





1 


1 


1 






6 


'0' 


'1' 


qo 




{'0\q2,L) 


qi 


{'0\qf,L) 




q2 


{'^\qf,L) 


{'0\qf,L) 



Figure 2.1: The XOR function and corresponding Turing machine action table. 



The transition function 6 makes a given machine M to behave like a computer with a fixed 
program. In this sense, only one function can be calculated. However, since the action table 
itself can be encoded as a string, we can say that a part of the tape is considered to be a 
program description and the rest is the input: 



'0101011... 1101... 010' 



'0101011... 0011... 100'. 



program input data program output data 

The Turing machine from the Example [T] can be interpreted as recognizing two programs: 

program '0' : perform identity on the input bit, 
program ' 1' : negate the input bit . 

Due to string manipulation nature, Turing machines (and various automata) are often studied 
in terms of languages they accept. 



Definition 2.1.3 (Accepting a language). A Turing machine accepts a language L iff 
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• for all strings x E L: the machine halts in a final state, 

• for all strings x ^ L: the machine halts in a non-final state or the machine enters an 
infinite loop. □ 

The Turing machine from the Example [T] halts in a non- final state for the blank symbol b (no 
program or input bit is given). 

Definition 2.1.4 (Time complexity). Let M be a Turing machine and f{n) a function / : 
N ^ N. We say that M has a time complexity /(n) if for each input of size n the machine 
halts after at most f{n) steps. 

Definition 2.1.5 (Space complexity). Let M be a Turing machine and f{n) a function 
/ : N — > N. We say that M has a space complexity /(n) if for each input of size n the 
machine utilizes at most f{n) cells before halting. 



2.1.1 Probabilistic Turing machines 

Definition 2.1.6 (Probabilistic Turing machine). A probabilistic Turing machine is a gen- 
eralized Turing machine where the transition function does not output only a single triple 
(output symbol, new state, shift), but a probabilistic distribution of such triples. Formally, 
the transition function assigns to each possible transition a non-negative probability: 

6 : Q xT. X Q xT. X {L,R} — > [0, 1] (2.1) 

in such a way that the set of transitions from one configuration cq to all its direct successor- 
configurations ci, . . . , Cfc must fulfill the local probability condition 

k 

Y.P^ = 1' (LPC) (2.2) 

i=l 

where pi is the probability of transition from cq to q . □ 



It may happen that several different paths I of computation lead to the same configuration 
Cx. In such a case, this configuration has a probability equal to the sum of probabilities of 
corresponding paths 

P(c.) = Efi'^- (2.3) 

I 

At any moment, the local probability condition assures that probabilities of all distinct con- 
figurations sum to one (global probability condition). 

^ K = 1. (GPC) (2.4) 

Definition 2.1.7 (Transition matrix). Let us have a Turing machine M. The transition 
matrix consists of elements Tjj defined as 

{Pi if the machine goes from Cj to q in one step with probability pi, 
otherwise. 
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□ 



Transition matrix for a probabilistic Turing machine is a stochastic matrix where each column 
sums to one (LPC). We can say that transition matrix T maps one normalized (GPC) linear 
combination (superposition) of configurations to another normalized linear combination of 
configurations. Thus stochastic matrices preserve the 1-norm (Eq. 2.6 page 16). For every 
column vector of configurations v, ||r-T;||-^ = \\v\\^. 

Transitions allowed by stochastic matrices can also be viewed in terms of constructive in- 
terference. The constructive interference is to be understood as the possibility for different 
computational paths to end up in the same configuration and thus increase the total proba- 
bility of that configuration. Probabilities of other configurations are proportionally smaller. 
One has to program a probabilistic Turing machine in such a way that the probability of 
a desirable configuration (correct result) is gradually enlarged, and probabilities of undesir- 
able configurations subsequently diminishes. Destructive interference might allow for more 
progressive separation of desirable and undesirable configurations, but with a probabilistic 
Turing machine this is not possible since we have only non-negative probabilities. 

Example 2 (Transition matrix and configuration tree). An example of stochastic transition 



matrix and a configuration tree starting in a configuration ci is shown in the Figure 2.2 
Local and global probability conditions are manifestly fulfilled at each level of the tree. The 
computation halts in a configuration C4 with probability p(c4) = 0.1-1-0. 4-0.4-1-0. 4-0. 6-1 = 0.5 
and in a configuration C5 with probability ^(05) = 0.5. 



/ 
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0.4 

















0.6 











0.1 


0.4 


1 


1 





^ 0.5 











1 / 



0.5: 

0.4 
0.1: 




Figure 2.2: An example of stochastic transition matrix and configuration tree with root ci. 



Definition 2.1.8 (Accepting a language on a probabilistic Turing machine). A probabilistic 
Turing machine PTM accepts a language L with completeness c and soundness s iff 

• for all strings x E L: PTM accepts x with probability p > c, 

• for all strings x ^ L: PTM accepts x with probability p < s. □ 

In order to study the power of a probabilistic Turing machine, we need to restrict real prob- 
abilities from the range [0, 1] only to a certain 'universal' set of probabilities. Assumption 
that all real numbers from the range [0, 1] with infinite precision can be used, would allow 
one to encode the hard problems right into them. C. H. Papadimitriou in [2" showed that for 
each probabilistic Turing machine Mi there exists a probabilistic Turing machine M2 with 
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probabilities restricted to the set {0, ^, 1} which simulates Mi with at most polynomial slow- 
down. The probability ^ shows a crucial dependence on the fair coin flipping if we assume a 
probabilistic Turing machine to be more powerful than a deterministic Turing machine. 



Example 3 (Probabilistic Turing machine with restricted probabilities). Let Mi be a prob- 
abilistic Turing machine using probabilities 0.4 and 0.6 at some part of the computation. Let 
M2 be a probabilistic Turing machine with restricted probabilities {0, ^, 1}. In the Figure 
M2 approximates Mi with precision e > 1/2^. 



2.3 



0.4/ \0.6 



M- 





A A 



• * 




Figure 2.3: Probabilistic Turing machine with restricted probabilities. 



2.1.2 Nondeterministic Turing machines 

Definition 2.1.9 (Nondeterministic Turing machine). Nondeterministic Turing machine is a 
hypothetical kind of a probabilistic Turing machine. It explores all the possible computational 
paths at parallel, and if the solution exists, then with non-zero probability the right path is 
actually taken. Equivalently, we can say that the machine goes along the right computational 
path, and if there is a fork, it nondeterministically chooses with non-zero probability the right 
path again. Nondeterministic Turing Machine NTM accepts a language L iff 



• for all X £ L: NTM accepts x with probability p > 0, 

• for all X ^ L: NTM accepts x with probability p = 0. 



□ 



Modern computers are usually not described as direct instances of a Turing machine. Their 
architecture is well described by abstract models as 'stored program' Random Access Machine 
(RAM) and synchronous/asynchronous Parallel Random Access Machine (PRAM). These 
models simplify algorithm analysis mainly due to grouping tape cells to fixed size 'words', 
which are uniquely indexed and can be thus directly accessed in a unit time as opposed to a 
Turing machine. 
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2.2 Complexity classes 

Algorithms and problems are categorized into complexity classes. 

Definition 2.2.1 (Polynomial-time, P). P is the class of decision problems deterministically 
solvable in polynomial time on a Turing machine. A language L is in a class P if 

• for all X £ L: the machine accepts x with probability p = 1, 

• for all X ^ L: the machine accepts x with probability p = 0, 

and the time complexity is upper-bounded by some polynomial poly{x). 

Definition 2.2.2 (Nondeterministic polynomial-time, NP). NP is the class of decision prob- 
lems nondeterministically solvable in polynomial time on a Turing machine. A language L is 
in a class NP if 

• for all X G L: the machine accepts x with probability p > 0, 

• for all X ^ L: the machine accepts x with probability p = 0, 

and the time complexity is upper-bounded by some polynomial poly{x). 

Equivalently, NP is the class of decision problems such that, if the answer is 'y^s', then there 
is a deterministic polynomial time proof of this fact. 

Definition 2.2.3 (Zero-error probabilistic polynomial-time, ZPP). ZPP is the class of de- 
cision problems probabilistically solvable in expected polynomial time on a Turing machine 
with zero error probability. A language L is in a class ZPP if 

• for all X G L: the machine accepts x with probability p = 1, 

• for all X ^ L: the machine accepts x with probability p = 0, 

and the time complexity is upper-bounded by some polynomial poly{x). 

Definition 2.2.4 (Bounded-error probabilistic polynomial-time, BPP). BPP is the class of 
decision problems probabilistically solvable in polynomial time on a Turing machine with 
bounded error probability. A language L is in a class BPP if 

• for all X G L: the machine accepts x with probability p > |, 

• for all X ^ L the machine accepts x with probability < ^ , 

and the time complexity is upper-bounded by some polynomial poly{x). 

The numbers | and | may be replaced to any a and b such that a = ^ + poly~^{x) and 
6=1 — poly~^{x). The Chernoff bound [3l says that by repeating trials the error probability 
diminishes exponentially fast and the success probability is accordingly increased. 
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Definition 2.2.5 (Probabilistic polynomial-time, PP). PP is the class of decision problems 
probabilistically solvable in polynomial time on a Turing machine but the error probability 
need not to be bounded by a polynomial. Compared to the BPP class, the numbers a and b 
are allowed to scale as ^ it exp~^{poly{x)). A language L is in a class PP if 

• for all X £ L: the machine accepts x with probability p > 1/2, 

• for all X ^ L: the machine accepts x with probability p < 1/2, 

and the time complexity is upper-bounded by some polynomial poly{x). 

Definition 2.2.6 (Polynomial-space, PSPACE). PSPACE is the class of decision problems 
solvable on a Turing machine whose space complexity is upper-bounded by some polynomial 
with respect to the size of the input. 

Definition 2.2.7 (Exponential-time, EXP). EXP is the class of decision problems determin- 
istically solvable a Turing machine whose time complexity is upper-bounded by an exponential 
function exp (poly(n)), where poly{n) represents a polynomial with respect to the size of the 
input n. □ 

It follows that P C ZPP O NP O PP G PSPACE C EXP and P C ZPP C BPP C 
PP C PSPACE C EXP. The relation of BPP and NP is unknown. However, it is beheved 
that P = BPP and P ^ NP. Detailed proofs and further information can be found in 



2.3 Linear algebra 



Table 2.1 summarizes the Dirac notation for notions from linear algebra. This 'bra(c)ket' 
notation is widely used within quantum mechanics. Another formalism based on density 
matrices will be introduced later. 



Notation 


Description 


\v) 


Column vector. Known as 'kef. 


{v\ 


Row vector dual to \v). Known as 'bra'. 


{ij\v) 


Inner product of vectors {ipl and \v). 




Outer product of \^^J) and {v\. 


<S) \v) 


Tensor product of {ip) and \v). 


mv) 


Abbreviated notation for tensor product of {ip) and \v). 




Abbreviated notation for tensor product of {ip) and \v). 


A^ 


Adjoint operator of the A matrix. A^ = (^A^Y = (A*)'^ . 


{i^\A\v) 


Inner product of {^p\ and A\v). 


\\v\\ 


Notation for a vector norm. 



Table 2.1: Dirac notation. 
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2.3.1 Hilbert space 

Definition 2.3.1 (Vector space). A set V = (V,+, • ) is called a vector space over a scalar 
field iff the operations + : V x V — V (vector addition) and • : x V — V (scalar 
multiplication) are defined and 

1. (V, +) is a commutative group with a neutral element , 
and for all v,il) eV, a,(3^T: 

2. a{f5\v)) = {a(3)\v), 

3. {a + l3)\v) = a\v) + f3\v), 

4. a{\v) + IV')) = a\v) + a\ili). 

Definition 2.3.2 (Vector norm). Let V be a vector space over a scalar field T. A vector 
norm is a function ||-|| : V — satisfying for all f, -0 G V, rj e J^: 

1. ||i;|| = <^ V = ~0, 

2. ||?7f II = \r]\ \\v\\, 

3. II IV') + \v) II < IIV'II + ||f||. (triangle inequality) 

Definition 2.3.3 (p-norm). Let p > be a real number and v = {vi,V2, ■ ■ ■ ,Vn) an n- 
dimensional vector. The p-norm is a vector norm defined as 

ii^iip= (izKy ■ (2-6) 

For p = 1 we get the taxicab norm and for p = 2 we get the Euclidean norm. 

Definition 2.3.4 (Inner product). Let V be a vector space over the field of complex numbers. 
An inner product over the vector space V is a function (-j-) : V x V — C satisfying for all 
V', A G V: 

1. {v\v) G 7^, {v\v) > 0, {v\v) = ^ 1^^) = "O , 

2. {v\i;) = {^|;\vr, 

3. {v\m + \X)) = {v\i;) + {v\X). 

The inner product induces the 2-norm ||i'||2 = ^/ {v\v). A vector \v) is normalized or unit- 
vector under the 2-norm iff ||f||2 = 1- 

Note. For a real or complex vector space V with an inner product (-j-) and norm ||-|| the 
following inequality holds, v,iIj £ V: 

|(V'I^)I ^ IIV'II ■ ll'^ll • (Schwarz inequality) 
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Definition 2.3.5 (Completeness). Let V be a vector space with the 2-norm ||-||2 and \vi) G V 
a sequence of vectors. 

• \vi) is a Cauchy sequence iff 

Ve > 3Ar > such that \ln,m> N : \\ - 1^^) < e. 

• is convergent iff 

3\v) e V such that Ve > BAT > Vn > TV : || \vn) - \v) II2 < e. 

Space V is complete iff every Cauchy sequence converges. 

Definition 2.3.6 (Hilbert space). A Hilbert space K is a vector space with an inner product 
(•|-) that is complete under the induced norm ||f||2 = \/ {v\v). 



Note. Standard quantum computing is defined only for finite dimensional complex 
Hilbert spaces, 7^ = C", and normalized (unit) vectors. 



Definition 2.3.7 (Kronecker delta function). The Kronecker delta function is a function of 
two variables (usually integers) defined as 

■' 10, otherwise. 



Definition 2.3.8 (Basis vectors). An enumerable set of normalized vectors jej) forms an 
orthonormal basis of a Hilbert space 7i iff 

1. : {ei\ej) = Sij, 

2. any vector \v) G H can be written as \v) = '^Zi^il^i)- 

Definition 2.3.9 (Dimension of a Hilbert space). The dimension of a Hilbert space H is the 
number of vectors of a basis of H. We write 

dim(7^) = |{|e,)}| , (2.8) 
where {|ej)} denotes an orthonormal basis of Tl. 

Definition 2.3.10 (Tensor product of two Hilbert spaces). Let Ha and Hb be Hilbert spaces 
with basis jej) and \fj) respectively. A tensor product 

Hab = nA®nB = {\v) ® IV') : \v) G Ua, IV') e ^s} (2.9) 

is also a Hilbert space 

• with base l^^) = {|e) (g) |/) : |e) G |ej), |/) G \fj)} and 

• inner product defined ?iS {a®h \ c® d) = {a\c){h\d), where |a), |c) G Ha 
and \h),\d) G Hb- 

• dim (H^b) = dim (7^^) • dim(7^B). 
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2.3.2 Lineeir operators 

Definition 2.3.11 (Linear operator). Let V be a vector space. Function A : V ^ V is a 
linear operator iff it is linear in its inputs, i.e. 

= «^ (^l^i))' e ^- (2-10) 



In C"^ a linear operator A can be expressed as an n-hy-n square matrix. 
/ 00,0 • • • ao,n-i \ 



A 



E°^jI^XjI. (^ij = {W)- (2.11) 



\ an-1,0 ■ ■ ■ an-l,n-l J 



i',J 



Definition 2.3.12 (Adjoint Operator). Let ^ be a linear operator on a Hilbert space H. A 
unique linear operator A^ on Ti satisfying 

{v\Aip) = {A'^ v\'il)), (2.12) 

for all vectors v,7p £ Ti., is called an adjoint operator or Hermitian conjugate of the operator 
A. Additionally, we define 

\v)^ = {v\. (2.13) 



Note. Let A and B be linear operators on a Hilbert space H, \v) G H. Then 

(AB)'' = B^A^, (2.14) 
{A\v))^ = {v\Al (2.15) 



Definition 2.3.13. A linear operator A defined on a vector space V is called 

1. identity operator I iff A\v) = \v) for all vectors \v) G V, 

2. zero operator O iff A\v) = for all vectors \v) G V, 

3. normal iS A^A = AA^ , 

4. self-adjoint or Hermitian iff A^ = A, 

5. unitary iS A^A = AA^ = I, 

6. idempotent iff A^ = A, 

7. projection iff A is self-adjoint and idempotent. 
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Theorem 2.3.1 (Spectral decomposition). Any normal operator A on a vector space V is 
diagonal to some orthonormal basis for V 



(2.16) 



where Aj are the eigenvalues of A, {\i)} is an orthonormal basis for V, and each \i) is an 
eigenvector of A corresponding to eigenvalue Aj. For proof see H] on page 72. 

Definition 2.3.14 (Linear operator on a composed Hilbert space). Let A, B be linear oper- 
ators on TLa-: '^b respectively. The tensor product 



A®B 



I ai^iB 



0'l,mB ^ 



is a linear operator on TLa ^TLb- 

{A(^B) K^adei)0/3,-|/,) 1 =Y,ai^A^\ei) B\f,)). 



(2.17) 



(2.18) 



h3 



2.3.3 Operator functions 

Definition 2.3.15 (Operator function). Let A = \i\i){i\ be a spectral decomposition for 
a normal operator A. An operator function / on ^4 is defined as 



f[A) = Y,f{h)m- 



(2.19) 



This allows us to define functions like square root, logarithm or exponential for operators. 
Definition 2.3.16 (Trace of a matrix). The trace of a square matrix A is defined as 

ii{A) = ^aii. (2.20) 



Note. Let A and B be linear operators and r/ G C 


. Then 




• ii{AB) =ii{BA), 


(cyclic property), 


(2.21) 


It{A + B) = tr(^) +tr(S), 
tr(r/A) = ri tr(^), 


(linear property) . 


(2.22) 



From the cyclic property it follows that the trace of a square matrix A is invariant under the 
unitary similarity transformation A — > UAU^. 



tr (UAU^) = tr (uU^a) = tr (A) 



(2.23) 



This property is important for the density operator formalism. See Section 2.5 on page [22 
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2.4 The postulates of quantum mechanics 

Postulate 1 (State space). Associated to any isolated physical system is a complex vector 
space with inner product (Hilbert space) known as the state space of the system. The state of 
the system is completely described by its state vector, which is a unit vector in the system's 
state space. 

Postulate 2 (Evolution). The time evolution of the state of a closed quantum system is 
described by the Schrodinger equation 

ih^^\v)=H\v), (2.24) 

where h is the reduced Planck constant h ~ 1.05457 • 10~^^Js and H is a fixed self-adjoint 
operator (hermitian) known as the Hamiltonian of the closed system. 

In practice, it is convenient to absorb h into H, effectively setting h = 1. The solution of the 



equation (2.24) constitutes a time evolution operator 

[/(At) = e-'^^\ (2.25) 

The time evolution operator [/(At) is a unitary operator since the Hamiltonian H is a her- 
mitian matrix, H = and therefore the unitarity condition is fulfilled, 

C/(At)[/(At)t = e"^^^* e™ = /. 

We can reformulate the second postulate using unitary evolution: 

The time evolution of a closed quantum system from the state \vi) at time ti to the state 
\v2) at time t2 is described by a unitary operator U = U{t2 — ti), 

\v2)=U\vi). (2.26) 

The correspondence between the discrete-time description of dynamics using unitary operators 
and continuous time description using Hamiltonians is one-to-one. 

Postulate 3 (Quantum measurement). A quantum measurement is described by a collection 
{Mm} of measurement operators. These are operators acting on the state space of the system 
being measured. The index m refers to the measurement outcome r^ that may occur in the 
experiment. Measuring the system state \v) will give the result rm with probability 

p{rra) = {v\mImM, (2.27) 
and the state of the system reduces to the post-measurement state 

I Mm\v) 



The operators {Mm} satisfy the completeness equation 



(2.28) 



Y,MlMm = I. (2.29) 

m 
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Using the completeness equation together with the normahzation condition, we can see that 
probabihties sum to one: 

1 = (^-) = E {y\MLMrn\v). (2.30) 



Note. We say that states \v) and are equivalent, \v) = \ip), up to the global phase 
factor, iff 

The statistics of measurement predicted for these two states are the same! 



The global phase must not be confused with the relative phase. Let |0), |1) form a basis of a 
Hilbcrt space H. States \v) = a|0) + /3|1) and lip) = a|0) — /3|1) defined on H do differ by a 
relative phase. 

Projective measurement 

For many applications a special class of measurements known as projective measurement is 
of importance. A projective measurement is described by a self-adjoint operator M, called 
an observable, with a spectral decomposition 

M = J2rmPm, (2.31a) 

m 

where 

^P^ = I and PmPn = SmnPm. (2.31b) 



m 



P„i is an orthogonal projector onto the eigenspace of M with eigenvalue r„i. The eigenvalues 
rm correspond to possible outcomes of the measurement. The probability of getting result 
and afterward state's collapse are given by 

p{rm) = {v\Pm\v), (2.32) 
\v) = (2.33) 

A projective measurement allows to express the measurement 

in an orthonormal basis \m) 



simply by defining 
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Pm =\m){m\. 

The corresponding observable M is then given by a Ust of projectors Pm- Actually, projective 
measurement is equivalent to the general measurement postulate when augmented with the 
ability to perform unitary transformations. See for details. Unless stated otherwise, 
projective measurement is the default measurement used in quantum computing. 



Note. The average value of a projective measurement is 

S(M) = J]]r„p(r„) =^r^(r;|P„|z;) = {v\ ( ^r„P^ I \v) = {v\M\v). (2.34) 
m m \ m / 

The average value E{M) is often denoted by (M). 

Postulate 4 (Composite systems). The state space TC of a composite physical system is the 
tensor product of the state spaces TCi of its components, 

n = (^ni . 

i 

Moreover, if the subsystems are in the states \vi) G TCi, then the joint state \v) £ TC of the 
total system is 

i 



Note (Entanglement). Let TC = TCa ®TCb be a Hilbert space. A joint state \v) € TC that 
cannot be written as tensor product of some vectors \va) £ TCa-, \'Vb) G TCb is said to be 
entangled, otherwise we call this joint state a product state. The volume of entangled 
states is much higher than the volume of product states [Aubrun, Szarek] . 



In entangled states, unitary operators and measurement performed on one system affect the 
state of the second system. In product states, these operations affect only the state of the 
target component. 

2.5 Density operator formalism 

Next to the state vectors formalism, there exists an alternative density operator (density 
matrix) formalism. The postulates of quantum mechanics can be equivalently written using 
density operators. Density operator formalism is of advantage when describing individual 
subsystems of a composite quantum system or dealing with quantum systems whose state is 
not completely known. 

Definition 2.5.1 (Density operator). Let a quantum system S with associated Hilbert space 
W be at a state \vi) G TC with probability pi- The density operator for the system described 
by an ensemble {pi, \ vi)} is defined as 



P = '^Pi\Vi){Vi 
i 



(2.35) 
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A density operator satisfies the conditions: 

1. trip) = 1, 

2. p is a normal operator and its spectrum consists of positive real numbers. 



□ 



A quantum state represented by a density operator p is said to be a pure state iff 

tr(p2) = 1. (2.36) 
Otherwise the state is said to be mixed. For a pure state described by a state vector \v) the 



equation (2.351 reduces to 



p =\v){v\. 



(2.37) 



Using the density operator formalism, equation (2.26) for temporal unitary evolution of a 
closed quantum system has the form 



p' = UpU^. 

This can be easily seen from a transformation 

u 



^Pi\vi){vi\ — > ^piU\vi){vi\U^ . 



Equations (2.27), (2.28) for the y postulate of quantum mechanics have the form 



p(r™) = tr [mIm^p^ , 



, MmpM, 



P 



p{rr, 



(2.38) 
(2.39) 

(2.40) 
(2.41) 



For composite systems described by the 4*'^ postulate where the individual components are 
in the states pi, the joint state of the total system is 

i. (2.42) 



The reduced density operator 

When we deal with a subsystem of a larger system S whose state is described by a density 
operator p, we need to find a function which will provide the correct measurement statistics 
for this subsystem. Such a function is a partial trace function and the provided statistics is 
called a reduced density operator. It can be shown that a partial trace is the unique function 
with the above written property. 

Definition 2.5.2 (Partial trace). Let pA_ and pB be a density operator of a system A and B, 
respectively. The partial trace over system B is defined by 



trs {pA ® Pb) = PA tr {pb) ■ 



(2.43) 
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Definition 2.5.3 (Reduced density operator). Let be a density operator describing a 
composed state of physical systems A and B. The reduced density operator pA for system A 
is defined by 

PA = tTB (pab) ■ (2.44) 



Example 4 (Tracing out). Let pab be a four-by-four density operator describing a composed 
state of two two-dimensional systems A and B. According to the definition, the reduced 
density operator pA and pB are calculated by partial trace over system B and A, respectively. 
There are two practical approaches how to perform this tracing out. 

One approach follows directly from the definition of the partial trace. To be notationally 
clear, with respect to the state labelling, let us write 



PA 



PB 



J2 "<^.' 

9i,0'e{o,i} 
V',V'e{o,i} 



then 



PA® PB= ^ \4'){(t>\ ® PB 

</.,</.'e{o,i} 

ao,o PB ao,! PB 

"1,0 PB "1,1 PB 

0,</.'G{O,l} ^,^^-'£{0,1} 

Y Oi4>,'t>'P^,^'\(t>)\'^){(t>'\{'^'\ 

<t>,<t>' 

I "o,o/?o,o "o,o/5o,i "o,i/3o,o oo,i/3o,i \ 

"o,o/3i,o ao,o/3i,i Q!o,i/?i,o ao,i/3i,i 

Q!i,o/3o,o ai,o/3o,i "i,i/5o,o "i,i/3o,i 

V "i,o/?i,o ai,0/5i,i «i,i/3i,o q;i,i/3i,i / 

</.,V,<^',V'e{o,i} 

3 

^ X^,y|7)(7'| 
7,7' =0 

/ a^o,o a^o,i -^0,2 •'ecs \ 
a;i,o 3^1,1 xi^2 a;i,3 

2^2,0 3^2,1 2^2,2 a;2,3 

V a^3,o 2:3,1 X3,2 a;3,3 / 
Now we can see that the trace of the upper-left two-by-two submatrix gives us 



tr I ' ^' =tr(ao,oPB) = ao,o = a;o,o-Fxi,i, 
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since tT^ips) must be equal to one. System B is traced out. Accordingly, we can take a 
submatrix consisting of items on positions related to /3o,o trace out system A, 



tr 



X2fl X2,2 



tr(/?o,o pa) = /3o,o = XQfl + X2,2 



Thus the reduced density operator for the system A is 

/ 

PA = tlBiPAB) = trs 



/ a^o,o xo^i xo,2 a:o,3 \ 

2^1,0 3^1,1 Xi^2 Xi^3 

X2,0 X2,l X2,2 X2,3 

\ X3fi X3,l X3,2 X3,3 / 



tr 



tr 



2:0,0 xo^i 

Xlfl 

2:2,0 2:2,1 

2:3,0 23,1 



tr 



tr 



2:0,2 2;o,3 

2:1,2 21,3 

2:2,2 22,3 

2:3,2 23,3 



2:0,0 + 21,1 2:0,2 + 21,3 
2:2,0 + 23,1 X2,2 + 23,3 



The reduced density operator for the system B is 
/ 2:0,0 2:0,1 20,2 2:0,3 \ 

, / N , 2:10 2:1,1 Xi,2 2:13 

PB = tlAiPAB) = trA ' = 

2:2,0 2:2,1 22,2 2:2,3 

\ 2:3,0 2:3,1 X3,2 2:3,3 / 



tr 



tr 



2:0,0 2:0,2 

2:2,0 2:2,2 

2:1,0 2:1,2 

2:3,0 2:3,2 



tr 



tr 



2:0,1 20,3 

2:2,1 22,3 

2:1,1 21,3 

2:3,1 23,3 



/ Xo,0 + 2:2,2 2:0,1 + X2,3 \ 
V 2:1,0 + 2:3,2 Xi,i + X3,3 / 

A different approach involves direct formulas for tracing out. These formulas are derived from 



the trace definition (2.20) and the partial trace definition (2.43), 



PA = iT^BiPAB) 
PB = tTAiPAB) ■ 



<)!.,</i'e{o,i} 



J2 ^"^'^1 w,^') 

^£{0,1} 



(2.45) 
(2.46) 



iV') ( E {<p,^\PAB\<p,i^')) (^'|. 

jp,ilj'&{o,i} 0e{o,i} 

An insight into these formulas gives a simple rule how to calculate a partial trace over a given 
system. Let pab be written in the form of 

PAB = ^ 2:<^,^,<^,^' \(j),tp){(l)',ip'\, 

then the partial trace over the i-th system (qubit) is evaluated by replacing an outer product 
term for this system with a corresponding inner product {x\y). 



. Then, 

20,1,1,1 |0)(1| + 



For example, let pab = 2:0,1,0,0 |01)(00| + 29,1,1,1 |01)(11| + 

trB(pAB) = (2:0,1,0,0 |0)(0| (1|0) + xo,i,i,i |0)(1|(1|1) + •••) 

=0 =1 

trA(pAB) = (2:0,1,0,0 1 1)(0|(0|0) + xo,i,i,i |1)(1| (0|1) + •••) = xo,i,o,o |1)(0| + 

=1 =0 



□ 
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Chapter 3 

Quantum computing 



3.1 Quantum computing 

Quantum computing is an abstract concept of computation defined within the framework of 
quantum mechanics. The postulates of quantum mechanics relate the set of allowed states to 
unit vectors in a complex Hilbert space, allowed transitions are described by unitary matri- 
ces and the measurement reveals complex amplitudes only indirectly via the corresponding 
probabilities. For the concept of quantum computing, it is convenient to adopt these rules in 
the following way. 

3.1.1 Quantum states 

The smallest nontrivial quantum mechanical system is a two-state system. In the context of 
quantum computing, it is called a quantum bit, or a qubit for short. Examples are two distinct 

polarization states of a photon, or the two spin directions of an electron in a magnetic field. 
The associated state space is a two-dimensional complex Hilbert space 7^2 which is spanned 
by an orthonormal basis B = {|0), labeled in some canonical way. Labeling |0) and |1) 
refers to the standard (computational) basis defined as: 



An arbitrary qubit state \v) can be written as a normalized linear combination (superposition) 
of basis states 



The complex numbers a, (3 are so-called quantum mechanical amplitudes. The condition 




(standard basis) (3.1) 





(qubit) 



(3.2) 



ap + |/3p = l 



follows from the 2-norm unity condition ||i'||2 = 1- We have 




s/ {v\v) = 1 ^ {'^\'^) = 1 
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and for the standard basis we directly get 



{v\v) = {a* 13*) 



aa* +(3(5* = \a\^ + \(3\^ = 1. 



For any other orthonormal basis, e.g. 

1 M 



10') 



V 1 



\l') = -i ' 



(dual basis) (3.3) 



the same is true. 



In principle, it is also possible to work with three-state systems (qutrits) or general d-state 
systems (qudits), but there is no actual advantage of doing so, as well as for classical trits/dits. 
For this reason, we can restrict ourselves to qubits and larger systems composed out of qubits. 
The joint state of a composed system is given by the tensor product of its individual subsystem 
states. Let us have two qubits \v)^ G 'H2-, \v) = ajO) + (3\1), |V') = 7|0) + (^11). Their tensor 
product is equal to 

|i;)|V) = a7|0)|0) + a5|0)|l)+/37|l)|0)+/37|l)|l), 
and we can rewrite this equation in the form 

=aoo|00) + aoi|01) + aio|10)+aii|ll) = ai\i). 

i6{0,l}2 

States |00), |01), |10), |11) are the standard basis vectors of the Hilbert space 'H2'i- 



1 00) 



1 10) 



/1\ 






1 



101) 



111) 



1 



/o\ 




V 1 / 



Labels 00, 01, 10, 11 may be renamed to 0, 1, 2, 3 because they can be easily seen as a binary 
representation of these integers. Using this representation, we write 

3 

\v)\'4)) = ao|0) + ai|l) + a2\2) + a3|3) = ^ai|z). 

i=0 

A general state of an n-qubit system (often called a quantum register), G 712" ■, is described 
as 

2"-l 

IV') = Oii\i) = ai\i), (quantum register) (3.4) 

■tG{0,l}" i=0 

where |ajp = 1 and {|^)} is the standard basis of an 2^-dimensional Hilbert space 7^2". 
Equation (3.4) shows how a state space of quantum system grows exponentially with its 
physical size - that is the number of the qubits. It is due to the property of tensor product 
of Hilbert spaces (def. 2.3.10| ) that 

dim(WA ® Hb) = dim(W^) • dim(7^s) . 
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3.1.2 Measurement 



It may seem that an n-qubit register is capable of storing exponentially more information than 
an n-bit register. However, the Holevo theorem |5] states that one can retrieve faithfully only 
n bits from an n-qubit register. Using other words, retrieving of classic information from a 
quantum register requires measurement and by the 3'"'^ postulate, we know that measurement 
destroys the superposition. In particular, let W be a state space spanned by basis B, then the 
projective measurement associated with some observable 



m 



where Pm are orthogonal projectors 



projects the state \^p) € Ti., 



-\m){m\, \m) G B, 



to the post-measurement state 



with probability 



m){m\i) 



p{r„ 



\OLr 



\m) = \m), 



\Olm\ , 



where is the outcome of the measurement and am{\ctm\)~^ is an unobservable global phase. 
It is also possible to measure only a part of the register at a time. For product states, the 
rest of the register is kept untouched, for entangled states, the whole register is affected. 

Example 5 (Projective measurement). 



Product state. Let = a|000) + /3|001) + 7IOIO) + 5|011) G ^33, C(,p,-f,6 + 0. It 
is a product state since jt/') = |0) (a|0) -|- (c|0) -|- d\\)) for some a, 6, c, d satisfying 
a = ac, /3 = ad, 7 = 6c, and b = hd. Measuring the middle qubit with respect to the 
standard observable 



M 



1 • 



1 




+ (-1) 




1 



A=|iXi| 



yields the post-measurement state 



' c|000) -hd|001), with probability |ap, 

and the result of the measurement is -|- 1 , 
c|010) dlOll), with probability \hf , 

and the result of the measurement is — 1 . 



The average value of this measurement is (M) = |a|^ — Results -|-1 and —1 are to 
be understood as observing and 1, respectively, in the measured register. 
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Entangled state. Let \ip) = a\00) + £ H22, a,/? / 0. It is an entangled state since 

IV') cannot be written as a tensor product of two qubits 

(a|0) + 6|l))(c|0) + = ac|00) + ad|10) + 6c|10) + 6d|ll), 

because 

fac = a^ac^O\ ./r. l /r. 

\bd = l3^bdy^0j ^ ^ 

Measuring the left qubit yields the post-measurement state 

1 /'\ _ / 1^^)' with probability \af , and the result of the measurement is +1, 
\ 1 11), with probability , and the result of the measurement is —1. 

It can be seen that the measurement of the left qubit uniquely determined the state of 
the right qubit. 

□ 



Classical vs. probabilistic vs. quantum register 

We can now compare a classical, probabilistic and quantum register composed out of n two- 
state systems. 



Classical register: 


X , 


X e {0,1}" . 




Probabilistic register: 


Y^PxX , 

X 


xG{0,l}", Pa,eR+ 


, Y^Px = 1 • 

X 


Quantum register: 


J2(^x\x) , 


X G {0, 1}^^ , a^eC, 






X 




X 



A classical n-bit register can store any string from the set {0, 1}". Depending on the assigned 
semantic, these strings can be interpreted as nonnegative integers {0, . . . , 2" — 1}, restricted 
set of real numbers, characters, and so on. The important point is that the register contains 
only one such string at a time. This is in contrast with a probabilistic register which contains 
a probabilistic distribution of all possible n-bit strings. These are exponentially many with 
respect to the length n. However, only one string is observed upon measurement. If we 
want to observe a different string, we need to repeat the whole computation as the former 
probabilistic distribution is no longer available nor it can be cloned right before measurement 
for obvious reasons. A quantum register can also contain a special distribution of all possible 
n-bit strings. To each possible string is assigned a complex amplitude and we talk about a 
quantum superposition. After a measurement of all qubits, the superposition is no longer 
available and we observe a single string only. In this sense, a quantum register is very similar 
to a probabilistic register. 
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3.1.3 Evolution of quantum states 



However, a probabilistic and a quantum register differ in the transitions they can undergo. 
An evolution of a quantum register is described by a unitary matrix U, {tp') = Ulip). 
Since for every unitary U there exists its inversion U~^ = U\ such an evolution is always re- 
versible, U~^\il)') = U'^U\il)) = Models of classical computation are usually not reversible, 
nevertheless, Bennett in |6l showed the existence of reversible universal Turing machines, and 
Fredkin and Toffoli showed a set of universal classical reversible gates for the circuit model. 
Therefore the restriction to reversible computation should not be considered as an obstacle. 
In principle, for any computable function / : {0, 1}*^ — > {0, 1}™, there is a unitary matrix Uf 
corresponding to the reversible version of /. A quantum computer is at least as powerful as 
a classical computer [8] . The operator U j for a nonreversible classical function / is typically 
implemented to perform a bijective mapping 



Uf : \x,y) — > \x,y® f{x)), 



(3.5) 



where x £ {0, 1}", y £ {0, 1}™ and © denotes the bitwise addition modulo 2 (equivalently, 
bitwise exclusive disjunction). By setting the second register to zero, \y) = |0) = lO^'")) = 
|0, . . . , 0), we get a computation 



Uf\x,0) = \xj{x)). 



(3.6) 



Classical reversible functions and quantum specific transforms (inherently reversible) perform 
mapping 

Uf : \x) \f{x)). (3.7) 

A quantum algorithm typically consists of several different transforms applied to various 
quantum registers or individual qubits. This can be graphically depicted as shown in the 



Figure [XT} The figure shows a procedure consisting from three evolutionary steps C/i, C/2, U3 
applied over eight qubits to an initial state |0) = |0(^)); = (f/3 • {U2 ■ iUi\0)))) = U\0). 



|0> 
|0> 



|0> 




Figure 3.1: Graphical scheme of a quantum algorithm. 



The overall unitary operation at the first step has the form Ui = A^'^'^Ci)I^^^(S)B^^^ . Analogically, 
U2 = l(2)(g)C('^)(gil(2), and C/3 = l(^)(g)D(2)0i[(2)^^(3)_ The upper index denotes the number 
of qubits over which the transform is applied. 

Examples of important unitary transforms over n qubits are the Hadamard transform and 
the discrete Fourier transform. Note that H^^^ = QFT^^\ 

2"-l 

: — J2i-'^T^\y)i^\ (Hadamard transform) (3.8) 

x,y=0 



32 



CHAPTER 3. QUANTUM COMPUTING 



2"— 1 

QFT^''') : ^ V e2'^'^^/2"|y)(x| (Fourier transform) (3.9) 

x,y=0 

It is easy to see that these transforms are indeed unitary, i.e. for the Hadamard transform, 
we have 

2"— 1 

^{n)^(n)t^ 1 1 ^ {-iry{-iry\y){x\x){y\ 

x,y=0 ^-^ 



2"-l 2"-l 2"-l 



2"-l 2"-l 2"-l 
y=0 x=0 y=0 



The Hadamard transform is often used to create an equally weighted superposition of standard 
basis states 



^^"^1^) = ^Y1 k)> \y) e B, (3.10) 

2" — 1 

^^"^|0) = E = + |1) + |2) + • • • + |2" - 1)). (3.11) 

j/=0 ^ 

Quantum parallelism Since unitary operators are linear operators, they are linear in its 
inputs. Let us prepare two quantum registers in the following state 



2"-l 

I V') = (iJ(") ® i^'")) |0, . . . , 0, 0, . . . , 0) = ^ E 1^' 0) ' 



a;=0 



then a single application of an operator U f results in a quantum parallel calculation of values 
/(a;)forallxG{0,...,2"-l}. 



2"-l 2"-l 2"-l 

a;=0 a;=0 a;=0 

However, this quantum parallelism alone is not very useful. A subsequent measurement would 
reveal exactly one pair (a;, f{x)) chosen at random. Such a process can be perfectly simulated 
by a probabilistic computation. One idea might be to clone the final superposition \jp') so that 
we can perform additional measurements, but the 'No cloning theorem' prohibits unknown 
state cloning. 

Theorem 3.1.1 (No cloning theorem). An unknown quantum state cannot be cloned. 
Namely, there is no unitary transformation performing evolution 

|X>|0)^|X)|X) (3.13) 
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for any state \x)- 

Proof. Let us have two different ortlionormal states and \v), and \x) = + 1^))- 

Assuming a 'cloning' U exists, we liave U{\ip)\0)) = \ilj)\ip), U{\v)\0)) = \v)\v). 

Additionally, 

u{\x)m = u (^-^m + |t;))|o)) = ^mmm + u{\vm)) = ^nm) + mv)) 

□ 



Note that the 'No cloning theorem' trivially holds for a probabilistic register too. Figure 3.2 
shows a hypothetical cloning matrix for a probabilistic one bit register. The matrix is not a 
valid stochastic matrix since its columns do not sum to one. 



/ 1 


. 


• \ 


/ 


pi 


\ 


[Pl \ 





1 . 






P2 
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. 











Pl 
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1 . 


• / 


V 





/ 


\P2 J 



Figure 3.2: A hypothetical cloning matrix for a probabilistic one bit register. 



The only possible way to make use of quantum parallelism is to employ quantum interference. 
Using interference phenomena, we can modify the superposition, for example, so that only 
a pair satisfying f{x) = 1 is measured with high probability. So far, we have no 

indication that interference as present in quantum mechanics can modify the superposition 
quickly enough so that A'^P-complete problems can be solved in polynomial time. Surprisingly, 
Abrams and Lloyd in [9] showed that even small non-linearities, if allowed by quantum physics, 
would enable for efficient A^P-complete problems solving. 

Example 6 (Grover amplitude amplification algorithm). Let us have a computable function 
/ : {0,1}" — > {0,1} and a corresponding unitary operator Uj. We are looking for a string 
X such that f{x) = 1. An example of such problem is a Boolean satisfiability problem or a 
database search. An unsorted database search of size is especially interesting problem since 
there is a complete lack of inner structure to be exploited. Classically, we need to check all 
items, one by one, in order to find the right one in the worst case. On a quantum computer, 
we can use a different approach leading to a square root speed-up. 

Let n = \\0g2 A] . Using a weighted superposition of basis states over n qubits, we can search 
through all N item with a single query to Uj 

2"-l 2"-l 

^/(t^ 5]|x)®|o)) = -= 5^|x)®|oe/(x)). 
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A small modification to the initial state of the second helps to change the computation in 
such a way that the values f{x) are conveniently transfered to the amplitudes. 

2" — 1 

Now, amplitude — 1/\/2" marks the item(s) with /(x) = 1 and amplitude l/-v/2" marks the 
rest of items. The amplitude of the desired item can now be amplified using a transform 
known as inversion about mean. 



(2|0)(0| - j (inversion about mean) (3.14) 

Inversion about mean applied to a general superposition produces transform 

2"-l 2"-l 2"-l 

(i/W(2|0)(0|-lW)F(")) J^a.lx) = (^^^ j;|j)(A;| - iW) J^a^lx) 

a::=0 ^ ^ j,k=0 x=0 

2"-l 2"-l 2"-l 2"-l 2"-l 2"-l 

= ^ E ux^i E - i^"^ E = 2 E • (E • F - E 

i,fc=0 x=0 a:=0 j=0 x=0 x=0 
J, ^ ^ , 

mean (a) 

2"-l 2"-l 2"-l 

= ^2(a)|i) - ^a.k) = ^(-a, + 2(a))|x) . 

j=0 x=0 x=0 

^ V ' 

may be relabelled 

Repeated sequential action of the operator Uf and inversion about mean is shown in the 



Figure 3.3 



y inversion y inversion 

^ about mean ^ about mean 



Figure 3.3: Amplitude amplification by inversion about mean. 

It is clear that in order to stop the amplification at the right point one has to know at 
least approximately the number M of items satisfying /(x) = 1. The number of steps of 
amplification then grows hke 0{^N/M), see [TO]. The number M can be exactly determined 
by the counting algorithm fl] if it is not roughly known by other means. 

Recently, a similar type of amplification has been reported in energy transfer in plants during 
photosynthesis □ 
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A different example of a quantum algorithm is the period finding algorithm. This algorithm 
is the only quantum part of the Shor factoring algorithm jl2j. With respect to the factoring, 
the task is to find the period r of a function fk,N{x) = (mod A'^) for given coprimes 
k and N . The number N corresponds to the number to be factored and k is chosen at 
random. Accidentally, if k is not a coprime to A^, then A; is a factor of N . Once the period 
r is determined, a classical post-processing algorithm checks whether r leads to a non-trivial 
factor of N . This happens with high probability. 

The period finding algorithm consists of three steps and we need two m-qubit registers, 
where m is chosen in the order of 0(log(A'^)). First, we create a state with the period r 
which we wish to determine in the first register. We do it by exploiting quantum parallelism 
and measurement on the second register. The circuit implementing C// is essentially a re- 
versible version of a classical circuit for modular exponentiation utilizing repeated squaring 
and requiring 0(m-^) universal gates. 



y|^)|0) X y|x)|/t^' modAT) y \x')\y) 

^ — ' parallelism ^ — ' measurement ^ — ' 

^ ^ {x' ■.y = k^' mod N} 



{\l) + \l + r) + \l + 2r)+---)\y) 
y^\l + jr)\y) 



The result of the measurement is some non-negative integer y. Now, the superposition in 
the first register starts with a label where / is equal to the smallest x such that y = k^ 
(mod N). We call / an offset, I < r. Note that in general 2"^ is not an exact multiple of the 
unknown r and therefore the amount of terms in the sum XljK ~^ j^) is not 2™'/r exactly. 
However, if 2"^ is sufficiently large, then the small decay of the periodicity at x close to 2"^ 
will have a negligible effect. Thus 

2™ 

|{j} = {0,l,2,...}|~ — . 

r 

Second, we apply the quantum Fourier transform to the first register. Quantum Fourier 
transform over Z2"i requires O(m^) gates. The Fourier transform maps functions with period 
r to functions having non-zero values only at the amplitudes of the frequency 1/r. 

Thus we get rid of the offset and neglecting states with negligible amplitudes the number of 
terms in the superposition is strikingly decreased. It is now proportional to r. There are 
exactly r states with amplitude peaks and other states with smaller amplitudes are clustered 
around these peaks. Therefore, a subsequent measurement on the first register produces with 
high probability an m-bit non-negative integer 

a ~ ja — , 
r 

where ja G {0, 1, 2, ... r — 1}. Third, we take a rational number and using a continued 

fraction expansion we find a convergent which resembles ja/f. Thus we can extract r. The 
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continued fraction expansion can be computed using 0{m'^) gates for elementary arithmetic. 

a 1 ja 

— = OMm-lClm . . . ao = " =^ — 

2"^ ^ ' 1 r 

m— bits Ci + 

1 

C2 + 



C3 + • • • 



Choosing m in the order of 0(log(A^'^)) ensures that r is revealed with high probability. A 
continued fraction expansion is a very important part of this algorithm. 



3.2 Quantum Turing machines 



The first formal definition of a quantum Turing machine, viewed as a quantum physical 
analogue of a probabilistic Turing machine, was given by D. Deutsch [13^ in 1985. The 
existence of a fully universal quantum Turing machine which can simulate any other quantum 
Turing machine with at most polynomial slowdown was proven by Bernstein and Vazirani 
|14] in 1993. Additionally, they proved that there is an oracle relative to which there is 
a language that can be efficiently accepted by a quantum Turing machine but cannot be 
efficiently accepted by a bounded-error probabilistic Turing machine. The problem which was 
considered is called Recursive Fourier Sampling and the proposed quantum algorithm gives a 
quasipolynomial speedup, 0(n) versus 0(n^°s")_ This provides the first formal evidence that 
a quantum Turing machine is more powerful than a probabilistic Turing machine. 

Informal evidence is present in promise problems such as the Deutsch- Jozsa problem |15] . 
the Simon problem [16] or Shor's factoring algorithm [12]. However, these problems are only 
assumed to be hard, it is not proven. For example, the Deutsch-Jozsa problem was later 
shown to be in the complexity class BPP [T^ and thus efficiently solvable on a probabilistic 
Turing machine. In this case, the quantum algorithm for the Deutsch-Jozsa problem only 
gives an advantage of deterministic approach instead of a probabilistic one. Regarding the 
Simon promise problem, its complexity was elaborated from the former expected quantum 
polynomial time to the exact quantum polynomial time [T7]. The Simon promise problem 
was the first 'solid' problem where a quantum algorithm yields an exponential speedup. 

Definition 3.2.1 (Quantum Turing machine). A quantum Turing machine is a generalized 
Turing machine. The machine has a finite control (finite set of states Q), possibly infinite 
tape, and a read/write head that recognizes a finite alphabet S. A transition function assigns 
to each transition a complex amplitude 



(5:QxSxQxSx{L,ii}^C (3.15) 

and the corresponding finite transition matrix is unitary. A particular configuration is ob- 
served with a probability equal to the squared absolute value of the amplitude associated 
with that configuration. □ 



The restriction to unitary matrices can be derived from the need of preserving the inner 
product as only unit vectors represent valid quantum states. A unitary matrix is the only 
finite dimensional square matrix that preserves the inner product. The property of a unitary 
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matrix 
orthogonal; 



I is equivalent to the assertion that column vectors Cj of U are normalized and 



for all i,j : {ei\ej 



The normalization under the 2-norm, ||ej 



= 1, is to be compared with the local probabil- 
ity condition (Eq. 2.2) for a probabilistic Turing machine. Columns of a stochastic matrix 



are normalized under the 1-norm and for a probabilistic Turing machine this ensures that 
a normalized linear combination of configurations is mapped to another normalized linear 



combination of configurations (Eq 2.4). However, for a quantum Turing machine having nor- 
malized columns of transition matrix is not sufficient to ensure that normalized states are 
mapped again to normalized states. This is due to the interference phenomena. 

It may happen that several different paths ^ of computation lead to the same configuration 
Cx. In such a case, this configuration has an amplitude equal to the sum of amplitudes of 
corresponding paths. The configuration is then observed with probability 



E 



a 



(^) 



a 



(3.16) 



We talk about a constructive interference if 

2 



E 



a. 



and about a destructive interference if 



E 



< > a 



(3.17) 



(3.18) 



For a probabilistic Turing machine, ax G M+, we have only constructive interference in the 
form of 



E 



a 



E 



a 



(3.19) 



which can be seen as a special case of the equation (3.17), up to the used p-norm 



Example 7 (Destructive interference). Let us have a quantum Turing machine whose transi- 
tions are described by a unitary matrix T and the computation starts from the configuration 
cq. a three-step evolution is shown in the Figure 3.4 Observe that at the second level we 



have non-zero probability to observe configuration ci. At the third level, the probability of 
observing ci is zero due to the destructive interference. 

Definition 3.2.2 (Accepting a language on a quantum Turing machine). A quantum Turing 
machine QTM accepts a language L with completeness c and soundness s iff there is a 
configuration c(x) = {x',qf,m), where qf € F, m G {L,R}, and the machine halts in a 
superposition of configurations ai\ci) such that 
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^0 



V 



P(Co)=l 

P(Co)-i 



Co Co q + + - |q p(Co) = l 

Figure 3.4: The power of destructive interference. 

• for all strings x £ L: the probability p = aj |(c(a;)|cj)p > c, 

• for all strings x ^ L: the probability p = ^ - ai |(c(2;)|cj)|^ < s. 

Definition 3.2.3 (Exact or error-free quantum polynomial time, EQP). EQP is the class 
of decision problems efficiently solvable on a quantum Turing machine QTM with zero-error 
probability. A language L is in the class EQP if there exists a QTM such that 

• for all X G L: the machine accepts x with probability p = 1, 

• for all X ^ L: the machine accepts x with probability p = 0, 

and the time complexity is upper-bounded by some polynomial poly{x). □ 

The EQP class was defined in |14] and, unfortunately, there is no theory of universal quantum 
Turing machines for exact quantum computing. This is due to the formulation "if there exists 
a QTM such that ..." in the definition of the class. Therefore showing that a problem is in 
the EQP is of limited theoretical value. In the circuit model for quantum computing (the 



model is described in Section 3.3), Deutsch-Jozsa and Simon promise problems are known to 



have error- free efficient circuits while using only gates from a universal set of gates. 

Definition 3.2.4 (Bounded-error quantum polynomial time, BQP). BQP is the class of 
decision problems solvable in a polynomial time on a quantum Turing machine with bounded 
error probability. A language L is in the class BQP if 

• for all X £ L: the machine accepts x with probability p > 2/3, 

• for all X ^ L: the machine accepts x with probability p < 1/3, 

and the time complexity is upper-bounded by some polynomial poly{x). □ 

The class BQP is considered to be the class of feasible problems for a quantum computer. It is 
a quantum analogue of the class BPP. It contains problems such as factoring and the discrete 
logarithm problem |12j . Pell's equation [TH] and simulation of quantum systems having a local 
Hamiltonian [19^. The authors of |20] proved that BQP contains BPP and is contained 
in PP; BPP C BQP C PP. The relation of BQP and NP is unknown. 
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Concluding remarks for quantum Turing machines 



Lemma 3.2.1. Any quantum Turing machine Mi can be simulated with constant slowdown 
by a quantum Turing machine M2 which uses only real amplitudes. 

Proof. Let us have a state {ip) = Oik\k). A complex number a = a + ib can be written as 
a two dimensional real vector: 



a 



= a|0) + 6|l), a,b€R. 
Then for a system composed out of qubits and amplitudes G M, we have 



Ml : Y 

fee{o,i}" 



fce{o,i}" 

= Yl ak\0,k) + bk\l,k) 
fee{o,i}" 

fee{o,i}"+i 



The transition unitary matrix is changed accordingly: 



Umi '■ 



a + ib 





1 


a —b 


— >■ Um2 '■ 




b a 




\ 





J 



Mutual simulation of quantum Turing machines with only real numbers is in greater details 
discussed in |14| 1^ . Additionally, Adleman, DeMarrais and Huang in |20j proved that 
problems contained in BQP can be efficiently solved using only amplitudes from the set 
{0,±|,±|,±1}. Kitaev [H] proved even a smaller set {0,ib;^,ibl} to be sufficient. This is 

to be compared with a sufficient set for a probabilistic Turing machine {0, ^, 1}. In [20], the 
authors raised an interesting question whether BQP = BPP]r, where BPPk is appropriately 
defined BPP class for a probabilistic Turing machine with restricted set of real amplitudes 
(probabilities). An affirmative answer would imply that the assumed power of quantum 
Turing machine comes only from possibly negative amplitudes (destructive interference) and 
it is independent of the use of the 2-norm. 

Proposition 3.2.2. A quantum Turing machine can be simulated by a deterministic Turing 
machine. 

Proof. The evolution of a quantum system is described by an equation |'i/;2) = Ulipi), where 
IV'i)) IV'2) are complex column vectors and U is a unitary matrix. Thus a deterministic Turing 
machine can simulate the evolution by a matrix-vector multiplication. 

Proposition 3.2.3. Naive simulation of a quantum Turing machine on a deterministic Tur- 
ing machine by a matrix-vector multiplication is not efficient. 

Proof. An n-qubit quantum system is described by an 2"'-dimensional complex vector. Corre- 
sponding unitary evolution operator is a 2"'-by-2" matrix. Thus the matrix-vector multiplica- 
tion takes 0(2^") steps. Simulation of a quantum physical system, described by a Hamiltonian 
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H during time At, is even more complicated since it involves large matrix exponentiation 

U{M) = e-*^^* = f; ^=^^1^ . (3.20) 
fe=o 

Lemma 3.2.4. A quantum Turing machine with transitions restricted only to product states 
(no entanglement) can he simulated by a deterministic Turing machine in linear time. 

Proof. Since there is no entanglement, the qubits evolve independently of each other. A 
simulation of a single qubit is efficient - it involves only multiplication of two-by-two matrix 
with a two-dimensional vector. An n-qubit system is thus simulated in time 0(n). 

Lemma 3.2.5. A deterministic Turing machine can efficiently simulate a quantum Turing 
machine with transitions restricted only to states such that entanglement is localized in chunks. 
A chunk consists of at most log{poly{n)) qubits and there are at most polynomially many 
chunks. 

Proof. Chunks can be simulated independently of each other. A simulation of one chunk is 
efficient. Chunks are at most polynomially many. 



3.3 Quantum circuit model 

The quantum circuit model is a computational model analogous to the standard Boolean 
circuit model. The model was introduced by D. Deutsch |[22| in 1989 and called quantum 
computational networks. Deutsch in his work also identified a three-qubit gate, the Deutsch 
gate, which is universal for quantum computing. The Deutsch gate is a quantum analogue of 
the Toffoli gate. 

A quantum circuit presents quantum gates in a sequence as they are applied to a quantum 
register. A quantum register comprises of individually addressable qubits which are depicted 
by horizontal lines (quantum wires) in a circuit diagram. The quantum register is initially 
prepared in the computational basis, typically in the state |0, 0, . . . , 0). Vertical lines denote 
joint operations over two or more qubits. This model allows us to express computational 
complexity of a given algorithm in the number of required elementary gates and/or a circuit 



depth. The notation for quantum circuitry is summarized in the Figure 3.5 

In 1993, Andrew Yao p3] elaborated the model and showed that any function computable in 
polynomial time on a quantum Turing machine has a polynomial-size quantum circuit. Two 
years later, several papers [231 [251 [261 123 EE] addressed questions related to gates construction 
and decomposition, proofs of universality of almost all two-qubit gates, and in particular, 
universality of a two-qubit gate called ControUed-NOT accompanied with single qubit gates. 

Since single qubit gates can be seen as continuous operators, they can be at best only approxi- 
mated to some precision e by a circuit consisting of gates from a fixed set of single qubit gates. 
The Solovay-Kitaev theorem |2H [29] proves that this approximation is indeed possible and 
induces only a polylogarithmic overhead. Importantly, Bernstein and Vazirani [2] showed 
that the total error caused by a sequence of imperfect (approximated) gates is at most the 
sum of errors of individual gates. 
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Figure 3.5: The circuit model notation. 



3.3.1 Single qubit gates 

Operations on a single qubit are described by 2-by-2 unitary matrices. Some of the most 
important unitary matrices are Pauli matrices X, Y, Z and identity matrix /. 



^loy' ~ \ i J ' ~ \ o -1 J ' ~ \ o 1 ^ 

Pauli matrices give rise to three useful classes of unitary matrices - the rotation operators 



2 2 



-t sm ^ cos ^ 



Ry{(P) = e-^^^/2 = cos^/-zsin^y = [ ^ ^m ^ ^^^^^^ 



2 2 



sm I cos I 



i^.(<^) . e-^^/^ = cos |/ - z sin |Z = ^ ^^^^^ j . (3.24) 

One reason why R{x,y,z}i'P) matrices are referred to as rotation operators is the Bloch sphere 
interpretation of their actions. 



Bloch sphere. A Bloch sphere is a unit sphere in Euclidean space M'^. A qubit state 
IV) = a|0) - 
rewritten as 



IV') = q;|0) + /3|1) parameterized by two complex numbers a,P : |a|^ + = 1, can be 



|V) = e'Mcos2|0) + e''^sin-|l)), (3.25) 
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where S,6,ip E M. The global phase factor e**^ can be ignored because it has no observable 
effect. The numbers 6,ip, interpreted as polar coordinates, define a point on a Bloch sphere, 
see Figure 3.6 We write the (x, y, z)-coordinates as an unit Bloch vector 

r = (sin ^ cos 99, sin ^ sin 93, cos^) . (3.26) 




Figure 3.6: The Bloch sphere. 



In the Bloch sphere picture, rotation operators R{x,y,z}{(l^) corresponds to rotating a qubit 
state about x, y and z axes by (/> radians. Moreover, since rows and columns of an unitary 
matrix are orthonormal, i.e. UU^ = U^U, arbitrary single qubit U can be written as 

/ gi(-a/2-7/2) I _gi(-a/2+7/2) | \ 

U = e { (3 27) 

which actually corresponds to rotations about only two axes 

U = e'^R,{a)Ryi(3)R,i-f). (3.28) 



Equation (3.28) is called the Z-Y decomposition of a single qubit gate. There is also a Z- 
X decomposition following from the substitution of Ry rotation by Rx rotation: Ry{P) = 
Rz{'7t/2) Rx{(3) Rz{—tt/2). In fact, arbitrary single qubit gate can be written as 

U = e'^Rnia) RraW) Rn{l) , (3.29) 

where m and h are non-parallel real unit vectors in three dimensions. Therefore all single 
qubit gates can be seen as operators performing rotations of a qubit state on a Bloch sphere. 

Important single qubit gates which appear very often in quantum circuits are the Hadamard 
gate (denoted H)^ n/S gate (denoted T), and phase gate (denoted S): 

It follows that H = e^^l"^ Rz{-k/2) Rx{tt/2) Rz{^/2), T = e*^/^ i?^(^/4), and S = T^. 
Several useful gate identities are: 
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. X^ = Y^ = Z^ = I, 

• HZH = X, HXH = Z, HYH = -Y, HTH = R^{Tr/4), 

• xR^{e)x = R,{-9), xRy{e)x = Ry{-e). 



3.3.2 Two-qubit gates 

The set of all gates over two qubits consists of separable and unseparable gates. Separable 
gates can be decomposed to single qubit gates and in this sense they are not considered to be 
two-qubit gates. Separable gates can be always simulated by single qubit gates. On the other 
hand, results of unseparable gates related to entanglement cannot be simulated by single 
qubit gates. For this reason, unseparable gates are referred to as entangling gates. 

DiVincenzo [21] has shown that certain two-qubit gates are already adequate in quantum 
computing. Barenco in |26] improved on results of DiVincenzo and original work of Deutsch 
by identifying a large class of two-qubit gates of form 



A{(i),a,9) 



(I 

1 



V 



-le 






cc 

i{a+4. 



-le 







i{o^-<P) sin e 



\ 



(3.31) 



sm I 



which is sufficient for construction of the Deutsch gate, D{9), see Figure 3.7a Parameters 
(j), a, and 6 in A{(p, a, 0) and D{6) are fixed irrational multiples of vr and of each other. 

Without depending on an exact proof [22] of quantum universality of the Deutsch gate, we can 
say the following. Due to irrationality properties that are required, a sequence of D{9q) gates 
with a chosen parameter 9q can generate the whole family of gates, D{9), asymptotically. The 
same applies to the A((j), a, 9) gate, where, in particular 

j4"(0o, ao, ^o) = A{(j)Q, nao (mod 2tt), n9o (mod 2tt)) . 

The family of gates D{9) comprises the Toffoli gate, Toffoli = -D(vr), and since ^(</>o, ao; ^o) 
gate is sufficient for construction of the D{9q) gate, this implies that the class of gates 
A{<j),a,9) is capable of classical universal reversible computation, at least. The Toffoli gate 



is depicted in Figure 3.7b 



I a) 
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1 












iRx{9) 
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(b) TofToli 
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(a) Deutsch gate 

Figure 3.7: Universal gates for quantum and classical reversible computing. 



To achieve the power of a quantum computer as assumed by the BQP class, the Toffoli gate 
must be accompanied with a gate which can manipulate the interference phenomena. The 
Hadamard gate or A{(j), a, 9) gates are examples of such gates. Therefore sets {Toffoli, 
and {A[(f),a,9)} constitute quantum universal sets in computational sense. 
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Definition 3.3.1 (Computationally universal set). A finite set of unitary gates G is called 
quantum computationally universal if every quantum Turing machine can be efficiently sim- 
ulated to arbitrary fixed accuracy by a circuit composed out of gates from the set G. □ 



Quantum computational universality of the set {Toffoli, H} was proven by Y. Shi [30^ in 2002. 
This result is in line with the minimal set of real amplitudes sufficient for universal quantum 



Turing machine; see Lemma 3.2.1 on page 39 Moreover, since the Hadamard transform 



is the Fourier transform over the group Z2, quantum computing can be roughly viewed as 
the Fourier transform plus a classical reversible computing. Indeed, the quantum part of 
the Shor factoring algorithm consists exactly of a reversible circuit calculating the function 
/fc,7v(^) = (mod N) for given coprimes k and N, and the Fourier transform over the 
Abelian group 

Universality of the A(<j), a, 6) gate as proven by Barenco |26] is also remarkable. No classical 
reversible universal gate with only two input and output bits is known. The Toffoli gate has 
three input/output wires and so has the primordial Deutsch gate. Furthermore, Deutsch, 
Barenco and Ekert in |27] and Lloyd |25) showed than almost any two-qubit gate is quantum 
universal. Thus the A{(j), a, 9) gate is not a special gate in this sense. It seems that universal 
computation independently of the classical or quantum framework is deeply embodied in 
nature. 

However, since A{(j), a, 6) already contains the essence of quantum universal computing, it is 
useful to study its structure. A matrix representation of the gate shows a layout of form 

/ 

u 

where [/ is a single qubit gate. Such a two-qubit gate applied to two qubits effectively acts 



like a ControUed-U gate, see Figure 3.8 The two input qubits are known as the control qubit 
and the target qubit. If the control qubit is set, i.e. |c) = |1), then U is applied to the target 
qubit, otherwise identity gate is applied, U^ = I, and thus both qubits are kept untouched. 



\t) —u— u-\t) 



Figure 3.8: ControUed-U operation. 



Due to the 'controlling' interpretation of some entangling gates they are also referred to as 
controlling gates. But, this term might be misleading, since it is not always clear who is 



controlling who. See Figure 3.9 where Hadamard gates lead to the exchange of the control. 



H 
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H 
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Figure 3.9: Difficulties with interpreting who is controlling who. 
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Out of controlling gates, the ControUed-NOT (CNOT) is a prototypical operation. Its action 
is described as 

CNOT: \c)\t) — >\c)\t®c), (3.32) 
and the matrix representation is 



CNOT 



/ 1 \ 

10 

1 

V 1 / 



(3.33) 



The importance of the CNOT gate comes from the fact that it is relatively easy to understand 
its action, and moreover, there is a constructive proof that any controlled single qubit gate 
U, controUed-U, can be constructed using at most two CNOTs and three single qubit gates. 
This proof is due to Barenco et. al. [28j. Since the A{(j),a,9) gate is sufficient for universal 
quantum computing this implies that CNOT and all single qubit gates are sufficient too. 

Theorem 3.3.1 (ControUed-U simulation). Let U he a single qubit gate. Then there exist 
single qubit gates A,B,C such that ABC = I and U = AXBXC. Controlled-U is then 
implemented by the following circuit. 



U 



- C B A - 



The control qubit decides whether operation ABC or AXBXC will be applied to the target 
qubit. 

Proof. By Z-Y decomposition, U = Rz{a) Ry{f3) Rzi'j) for some a, (3,^ £ M. Set 
A = Rz{a)Ry{/3/2), B = Ry{-(3/2) Rz{-{a + -/)/2) and C = i?^((-a + 7)/2). Then 

ABC = Rz{a) Ry{(3/2) Ry{-(3/2) Rz{-{a + 7)/2) Rz{{-a + 7)/2) = / 

^ V . ' 

/ Rz(-Ol) 

and using the identity / = XX ^ we have 

AXBXC = Rz{a) Ry{(3/2) X Ry{-(i/2) Rz{-{a + 7)/2) X Rz{{-a + 7)/2) 

= Rz{a) Ry{l3/2) X Ry{-f3/2) {X X) Rz{-{a + 7)/2) X Rz{{-a + 7)/2) 



Ry(l3/2) 



fl4(a+7)/2) 



Rz{a) Ry{f3) i?,(7). 



□ 



Barenco et. al. |28j in fact showed that arbitrary gate over n qubits can be constructed using 
only CNOTs and single qubit gates. With an assumption that arbitrary single qubit gates 
are available or can be efficiently approximated, the number of CNOTs basically describes 
the length of a circuit since at most one single qubit gate makes sense between two successive 
CNOTs acting on the same qubit. 

The authors of [28 gave the upper bound 0(n^4") and the lower bound 17(4") on the number 
of needed CNOTs for n-qubit entangling gates. Since the vast majority of all gates over 
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n qubits are indeed entangling gates this implies that computationally interesting unitary 
transforms requiring only polynomially many CNOTs are rare. Clearly, those rare ones can 
be hardly found by automatized brute-force decomposition. The upper bound 0(n^4") was 
derived using the QR-decomposition [31]. The lower bound 0(4") is a consequence of 2^ x 2" 
degrees of freedom of an n-qubit gate. 

In 2003, Vartiainen et. al. [32] improved the upper bound to 0(4"'). Vidal and Dawson 
|33j studied the lower bound for the limit case, n = 2, and showed that arbitrary unitary 
transformation over two qubits can be decomposed to a circuit containing at most three 
CNOTs and eight single qubit gates. An example of a gate requiring three CNOTs is the 
SWAP gate, see Figure |3T0 



\v) 



Figure 3.10: The SWAP gate implementation using three CNOT gates. 

Additional reason for choosing CNOT as an exemplary two-qubit gate is an easy entangled 
pair creation from a trivial product state |0,0). 

Example 8 (Entangled pair creation). 
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3.3.3 Evolutionary universal set of gates 

In order to capture most of the abstraction offered by a circuit model, it is useful to step from 
quantum computational universality to more strict evolutionary universality where every 
unitary evolution may be arbitrarily well approximated by a circuit composed out of gates 
from a fixed finite set. For example, the set {Toffoli, H} is evolutionary universal for gates 
with real entries but it clearly cannot be evolutionary universal for gates with complex entries. 

To formally define evolutionary universality we need a notion of approximation. For that 
purpose we define a distance function between two unitary operators U and U' as 

E{U,U') = \\U-U'\\ = max \UU - U')\ij)\\ , (3.34) 

\\tl>\\=i 

where the maximum is over all normalized quantum states \ip), and we say that operator U' 
approximates operator U to within e if 



E{U, U') <e. 
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The justification of this distance function comes from the fact that measurement out- 
comes are the only things that matter regardless whether U or U' was actually used. Let 
^ — Ylm '^mPm-, where Ylim ^rn = I ■, be an observable with orthogonal projectors Pm- Then 
Pu{fm) and pu'[fm) are probabilities of obtaining the outcome r.^ if U and U' were per- 



formed, respectively. The distance function E{U, U') as defined by (3.34) obeys the rule that 



if E{U, U') is small then the difference between outcome probabilities is small. In particular, 

\pu{rm) - Pu'{rm)\ < 2E{U, U'). (3.35) 



Proof. Let 



be an initial state. 



\Pu{rm) -PU'{rrn)\ = {lp 
= 



(projective measurement) 

- {m'^PmU'\ 



U^PmU\ij) - {^\U'^P^U'\^ 

U^PmU\%b) - {^\U^Pr,,U'\llj) + {ll^\U^PmU'\ 

u^Pmiu - u'M + (v|(t/t - C/'t)P„[/» 
U^Pm\A) + {A\PmU'\ib) (substitution |A) = {U - U')\'tp) ) 
U^Pm\A) +\{A\PmU'\Tp)\ (triangle inequality) 
< ^JiiplWUlip) (A|P^|A) + ^J{^\U'W\i;) (A|P™|A) (Schwarz ineql.) 

1/2 

{\ip) is normalized, and U, U' preserve the norm) 



2 (A|P^|A) 



A|P™,|Ai 



m 

2IIA 



1/2 



P™ , |A 



1/2 



2((A|A)) 



1/2 



2\\{u-u'm\ 

< 2E{U, U') . 



Definition 3.3.2 (Evolutionary universal set). A finite set of unitary gates G is called evo- 
lutionary universal if for every unitary gate U and e > there exists a sequence of gates 
u'i,u'2, . . . , u'f^ G G and ancilla state | a) such that 



max \\U{\ij))(S)\a) -U[U!2---U'k{\ij)(S)\a))\\ <e, 



(3.36) 



where U- gate corresponds to the gate u[ surrounded with identity gates for an appropriate 
number of qubits and ancilla \a) is an efficiently preparable state by means of gates from G. 
A set G typically consists of gates acting on 1, 2 and/or 3 qubits. □ 



The definition of evolutionary universal set utilizes a special form of the distance function 
where part of an input state is regarded as an ancilla state. The ancilla state allows to sets 
which are missing gates of small dimension still to be said to be evolutionary universal in all 
dimensions. 

Well-known evolutionary universal sets include: 

• {D{e)}, Deutsch [22], 

• {A{(t),a,0)}, Barenco [2H], 
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• {Toffoli, S, H}, Shor [S], 

• {Controlled-S, H}, Kitaev pT], 

• {Controlled-NOT, H, T}, Boykin et. al. [35]. 

Gates in these sets create only a tiny fraction of gates which can be implemented in a more 
or less straightforward way using current technologies. In light of evolutional universality of 
almost any two-qubit gate |27| |25] it should be easy to find different evolutionary universal 
sets using only the most feasible gates for a given physical system. Surprisingly, a borderline 
between evolutionary universal sets and sets which are not even quantum computationally 
universal can be very thin. 

D. Gottesman and E. Knill |36| 157] identified an important class of quantum circuits which 
can be efficiently simulated classically. This is the class of stabilizer circuits introduced in 
study of quantum error-correcting codes [35] . Consequently, the set of gates which generates 
this class of quantum circuits cannot be quantum computationally universal. 

Theorem 3.3.2 (Gottesman-Knill). 

Every circuit involving only the following elements: 

• state preparation in the computational basis, 

• gates Controlled-NOT, H, S, and the Pauli gates, 

• and measurements of observables in the Pauli group, 

can be efficiently simulated on a classical computer. 

Stabilizer circuits embrace not only all linear quantum error-correcting codes but schemes for 
entanglement purification [391110], quantum state teleportation [U], superdense coding [12| . 
and Greenberger-Horne-Zeilinger paradox |l3] too. Anders and Briegel [H] presented recently 
an algorithm based on graph-state formalism which simulates stabilizer circuits consisting 
of n qubits in time and space 0(nlog(n)). This result makes a numerical study of the 
above mentioned problems easily handled and shows how subtle is the power of quantum 
computation. 

An important figure of merit of a particular evolutionary universal set is whether its gates can 
operate in a fault-tolerant manner. Foundations of fault-tolerant quantum circuits were laid 
by P. W. Shor [5^ in 1996. He suggested to perform the computation and error-correction on 
encoded logical qubits without a need to ever decode them, and in such a way that an error 
on a single physical qubit cannot propagate to other physical qubits in the same logical qubit. 
This imposes constraints on both the type of unitary operations that can be performed and 
error-correcting codes used to encode logical qubits. For example, gates that perform rotation 
by an irrational multiple of vr cannot be realized in a fault-tolerant way [35] . Shor showed that 
the set {Toffoli, H, S} and CSS codes [IS] HB] conform to the restrictions and that a quantum 
circuit with t gates can tolerate 0(1/ log*^*) amounts of inaccuracy and decoherence per gate 
for some small constant c at a cost of polylogarithmic increase of the circuit. This result was 
later improved to hold for all codes encompassed by the stabilizer formalism [U]. Further 
utilization of concatenation of codes led to the threshold theorem |38| HS] H9] . which says 
that if the basic error rate is below some threshold, we can do arbitrary long computations. 
Currently the threshold is above 10~^. Next to the set {Toffoli, H, S}, the Kitaev's set 
{Controlled-S, H} and the set {Controlled-NOT, H, T} are fault-tolerant too. 
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Note that general methods for classical fault-tolerant computation with noisy gates also re- 
quire logarithmic increase in the size of circuits [50 . 

The set {Controlled-NOT, H, T} is the most commonly used evolutionary universal set. 
Hadamard and tt/8 gates can efficiently approximate arbitrary single qubit gate U and hereby 
together with the Controlled-NOT are sufficient to approximate the set {Controlled-NOT, all 
single qubit gates}. The possibility of approximation follows from the fact that a sequence 

HTHT = i?^(7r/4) R,{tt/4) = g-^^^/^)^ g-^^^/^^^ = iia(^c) (3.37) 

produces a rotation along the axis 

n = (cos7r/8, sinvr/S, cosvr/S) 

by a constant angle 6c which is incommensurable with tt [35] ; accordingly, 

HRn{9c)H = THTH = RM (3.38) 

with 

m=(cos7r/8, —sinvr/S, cosvr/S). 



Using Equation (3.29) we know that a single qubit gate U can be written as 

U = Rn{a) RrhiP) Rn{l) , 

and, additionally, thanks to 6'c/vr being irrational, a sequence of gates -R{m,n}(^c) can approx- 
imate any R[rh,h}{^) gate: 

^kn}(^^) = ^{-,n}(^^^ (mod2vr)). (3.39) 
Thus for given ^ > there exists a positive integer k such that 

E(i?{^,^}(0), R\^^^^m<i. (3.40) 

The question now is how the error accumulates while using approximate gates. Suppose that 
gates in a sequence U1U2 are replaced with their approximate version {/{ and U2. Then 

E{UiU2,U[U^) = \\UiU2-U[U^\\ 

= \\UiU2-UiU!2 + UiU!2-U[U^\\ 

< 1 1 ^^1 ( - t/2 ) 1 1 + 1 1 ( f^i - f^i ) ^^2 1 1 (triangle inequahty ) 

< ||f7i|| \\U2 — U2\\ + \\Ui — U[\\ ||f^2|| (submultiplicative prop, of Eq. (3.34)) 
= E{U2,U^)+E{Ui,U[), (llC/ill = 11^7^11 = 1) 

and, by induction, we can conclude that the error inccured by approximate gates adds at 
most linearly: 

m 

E{UiU2 . . . t/^, U[U^ ...U'^)<Y, E{Uj, U'^) ■ (3.41) 

i=i 

Thus if each gate in a sequence with t gates is accurate to ^ = e/t then the sequence is 
accurate to e. In conclusion, there exist positive integers a, 6, c such that 

E{U, W) = E{Rf,{a) RrM Rnil), Km RHOc) RU^c)) < e . (3.42) 
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Regarding the rate of convergence, a sequence of angles 9c fills in the interval [0, 2tt) roughly 
uniformly and therefore it takes at most 0{l/e) Hadamard and tt/8 gates to approximate 
a single qubit gate to accuracy e. Surprisingly, the Solovay-Kitaev theorem discovered by 
Solovay [29] and Kitaev [21] proves much faster convergence. 



Theorem 3.3.3 (Solovay-Kitaev). Let SU{d) denote the group of d- dimensional unitary 
matrices with unit determinant. Let G be a finite set of gates in SU {d) containing its own 
inverse such that the group generated by G is dense in SU (d) . Let e > be given. There is 
a constant c ^ 4 such that for any U £ SU{d) there exists a finite sequence U' = U[U2 ■ ■ . U[ 
of gates from G of length I = 0(log^(l/e)) such that E{U, U') < e. 

The Solovay-Kitaev theorem for SU{2), the set of all single qubit gates up to the overall 
phase, manifestly applies to Hadamard and tt/8 gates: {H, = H, T, T^ = T''} = {H, T} G 



SU{2), up to the overall phase, and according to Equation (3.42) the set {H, T} generates a 
dense subgroup in SU{2). 

The constant c is different for different approaches to the proof of the theorem. The algorithm 
described in [51] produces a sequence of length 0(log^^'^(l/e)), where 5 is a chosen positive 
real number. With additional restrictions imposed on G and usage of ancilla qubits there is 
an algorithm described in [5? which produces a sequence of length 0(log2 ( 1 /e) log(log( 1 /e) ) ) . 
The running time of both algorithms is polylogarithmic since they effectively produce a gate 
of the output sequence per step. Moreover, the authors of [53] gave a non-constructive proof 
that for a suitable G a sequence of length 0(log(l/e)) can be achieved. They also showed 
this result to be the best possible. However, it is not known which sets G are suitable and 
whether the compiling algorithm will be efficient. 

In conclusion, the Solovay-Kitaev theorem implies that an approximate circuit simulating 
a circuit with n qubits, /(n) CNOTs and consequently 0[f{n)) single qubit gates to an 
accuracy e requires 0{f{n) log^(/(n)/e)) gates from a universal set. 



Chapter 4 

Phase estimation and applications 



4.1 Fast quantum algorithms 



The discovery of the fast quantum factoring algorithm \i2\ by Shor in 1994 was immediately 
followed by a more general work of A. Yu. Kitaev [5l], who using group-theoretic approach 
gave an efficient algorithm for the abelian stabilizer problem. This problem subsumes the 
Deutsch-Jozsa problem [15], the Simon problem [16], factoring &; discrete logarithms and 
many other problems as particular instances. A study of techniques used by Shor and Kitaev 
showed that the discovery of an efficient circuit for quantum Fourier transform over finite 
abelian groups enables efficient solutions to the abelian Hidden Subgroup Problem (HSP) 
and the approach can be described as quantum Fourier sampling. For example, an efficient 
quantum algorithm for solving Pell's equation [1^ has been found using this framework. 

Definition 4.1.1 (Abelian hidden subgroup problem). Let G be a finite abelian group, X 
a finite set, and f : G ^ X a function such that there exists a subgroup H C G for 
which / separates cosets of H, i.e. f{gi) = f{g2) if and only if gi and g2 are members of 
the same coset gH. By querying a quantum oracle for performing the unitary transform 
Uf\g)\x) = \g)\x © f{g)), for g £ G,x £ X, and © an appropriately chosen binary operation 
on X, determine a generating set for H. 

A central challenge is to determine the hidden subgroup in time O {poly (log \G\)) including 
encoding of elements of G and X in terms of bitstrings, oracle calls, quantum circuit for 
(optimal) measurement and any needed classical postprocessing time. In the case of abelian 
groups, the key point is that an efficient circuit for the Fourier transform is known and the 
transform performs mapping from the group to its dual while respecting subgroups and cosets. 

Let G be a finite abelian group. The characters of G are homomorphisms x : G — > C\{0}, 
that is mapping such that >f((7i + 32) = ^(51)^(52) assuming additive structure of G and 
multiplicative structure of C\{0}. The characters form a group, called the dual group G, 
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\G\ = \G\, and using the characters the Fourier transform over the group G is given by: 

FTG=^5;x,«|j)(i|, i.e. |5) ^ (4.1 



1^1 tr V\G\ , 

For the case G = Z^r, the characters are described as >Cj{k) = e-2i"«i*;/iv _ ^jfc_ 
Corresponding to any subgroup H C G, there is a set of elements in G orthogonal to H: 

H^ = {geG \ o<g{h) = 1 for all h G H}. (4.2) 

The set of elements forms the orthogonal subgroup C G* to the subgroup H C G, 
where \H-^\ = \G\ / \H\. The Fourier transform over G, FTq, maps a subgroup H to its 
orthogonal subgroup H^. In particular, an equally weighted superposition on H is mapped 
to equally weighted superposition over H^ : 



and for a particular coset of H: 

\gH) = ^ E ^^omk)- (4.4) 

The standard approach for solving the abelian HSP is to create a random coset state, perform 
a quantum Fourier transform and sample the resulting state from H^ . Since {H^)^ = H, 
determining a generating set for H^ determines H uniquely. For example, in the factoring 
algorithm we have fk,N : x ^ (mod N), underlying group is Z^f, where M ^ N, the 
hidden subgroup is H = (r) = {0, r, 2r, . . .}, and H-^ = {M/r) = {0, M/r, 2M/r, . . .}. 



4.1.1 Algorithm for solving the abelian HSP 

1. Create a random coset state 

Create a superposition over all elements of G in the first register and call the oracle: 

Vl^l gee 

Next, measure the second register. This results in a uniformly chosen coset giH of H 
in the first register: 

^= ^\gihj{gi)). 
vl^l heH 

The second register is no longer in use now. 
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2. Fourier sampling 

Perform the Fourier transform on the first register again: 



The phase >t:g.{k) has no effect on a subsequent measurement and uniformly random 
k G H-^ is obtained. 

3. H reconstruction 

Reconstruct H from polynomiahy many samples. 



Note. Since the measured value f{gi) from the second register is actually never used, 
this measurement might in fact be skipped. In the first step of the algorithm, we prepare 
the state 

and after discarding (tracing out) the second register, due to the promise that / separates 
cosets, the first register is then in a mixed state 

where g is a coset representative. The state pn is called the hidden subgroup state. 
Implicit measurement, however, simplifies the analysis. 



4.1.2 New quantum algorithms 

Attempts to find new fast quantum algorithms which might make some of known hard prob- 
lems tractable naturally focus on various generalizations of the abelian HSP and underlying 
techniques. Efficient algorithms for non- abelian HSP are of particular importance because 
the HSP over the symmetric group encompasses the graph isomorphism problem and the HSP 
over the dihedral group subsumes the shortest vector in a lattice problem. 

Efficient algorithms for the HSP over non-abelian groups such as 'almost abelian' groups [55] 
or 'near Hamiltonian' groups (SH] have been successfully derived from the abelian approach, 
but in general straightforward quantum Fourier sampling fails since there is no dual group in 
the non-abelian case. An important result was the result of Ettinger et. al. [57] who showed 
that the query complexity of non-abelian HSP is polynomial as well as for abelian HSP. 
This means that there exists a measurement (a unitary transform followed by a projective 
measurement) over polynomially many samples of the hidden subgroup state pu which reveals 
information sufficient to reconstruct H. It was shown that for certain groups (including the 
dihedral group [58j) the measurement may be performed by repeated measurement on a 
single register containing the hidden subgroup state pu while other groups (including the 
symmetric group [^21 EO]) require measurement across multiple copies of pu- The problem 
is that the measurement even if correctly identified does not always have to have an efficient 
implementation. Moreover, classical postprocessing is not guaranteed to be efficient as well. 
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Measurement across multiple copies of the hidden subgroup state was for the first time used 
by Kuperberg [61 who gave a subexponential but not polynomial algorithm for the dihedral 
HSP. Utilizing measurement across multiple registers likewise, Bacon et. al. [62 gave recently 
an efficient algorithm for solving the HSP over certain semidirect product groups of the form 
Zp XI Z, for a fixed r (including the Heisenberg group, r = 2) and prime p. Bacon et. al. 
achieved this result in the framework of so-called 'pretty good measurement' (PGM) [63^ and 
later reinterpreted the result using the Clebsch-Gordan transform [63] . PGM turned out to be 
an optimal measurement for the dihedral HSP, however, no efficient implementation is known 
in this case. The Clebsch-Gordan transform is the key component in the recently discovered 
efficient circuit for the Schur transform [65j. The Schur transform is known to be useful 
in tasks such as an estimate of the spectrum of a density operator [66] or communication 
without a shared reference frame [BT]. Whether the Schur transform opens up for advances 
in non-abelian HSP is an open question. 

An alternative effort in finding new quantum algorithms focuses on what kind of other struc- 
tures may be efficiently revealed on a quantum computer. Partial results along this lines are 
discussed for the hidden shift problem |68| I69| and hidden nonlinear structures over finite 
fields [70]. 



4.2 Quantum Fourier transform based phase estimation 



While theory based on a quantum Fourier sampling provides a rather unifying view of the core 
of many quantum algorithms, the actual problem-solution approach is often quite different. 
One of the most fruitful approaches up to date is to cast the problem as an estimation of an 
eigenvalue of a certain unitary operator. Additional insight is that since unitary operators 
preserve the 2-norm the eigenvalues are of the form A = e^'^*'^ for some phase (p ^ [0, !)• Hence 
the goal is to estimate the phase. 

In general, designing efficient and numerically stable algorithms for finding the eigenvalues 
of an operator is one of the most important problems in linear algebra. Eigenvalues of 
small operators can be found by finding roots of characteristic polynomial, but this method 
cannot be used for large operators, see Abel-Ruffini theorem [71 . One implication of the 
theorem is an expected iterative nature for any general eigenvalue algorithm. A stable classical 
method for finding eigenvalues is the QR-algorithm [72] which iteratively executes the QR- 
decomposition [31]. For an N x N operator U, each QR iteration requires O(iV^) operations. 
Other methods utilize calculation oiU,U'^ , . . . (power iteration) and the overall complexity 
of these algorithms scale as 0{N^) too. Thus eigenvalues (or even a single eigenvalue) of an 
operator of size 2" x 2" are found inefficiently with respect to n. A quantum computer can 
often perform better given certain constraints on U. These constraints relate to the existence 
of efficient quantum circuits (efficient with respect to the size of the input n) for performing 
controlled powers U . Such constraints are not known to be helpful for classical algorithms. 
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4.2.1 Quantum phase estimation 

The main idea in quantum phase estimation is to consider a register in a basis containing 
eigenvectors of the unitary operator related to the problem being solved. From the definition 
of eigenvalues and eigenvectors, when an operator U acts on one of its eigenvectors the result 
is a scaling of this vector by a corresponding eigenvalue: 

C/|^) = A|V). 

In another words, the eigenvalue is kicked in front of the register. The trick behind quantum 
phase estimation is to exploit the eigenvalue kick-back in combination with the ability to 
efficiently perform controlled powers U^ and transfer the phase 27r(2'^(/)) into the relative 
phase of qubit in another register. Since U is a linear operator, the same concept applies to 
an arbitrary input superposition of eigenvectors of U. 



The very basic scheme which utilizes only a single controlled- C/ gate is shown in the Figure 4.1 



The upper line is the ancillary qubit which is measured, and the lower line represents space 
of n qubits on which U operates. Initially the ancillary qubit is set to |0) and the lower line 
register to an eigenstate \Tp) of the operator U with eigenvalue e^'^*'^. 



|0) -H 



H 



Figure 4.1: Eigenvalue kick-back circuit. 



The process of estimation can be divided into two stages. At the first stage, the eigenvalue 
g27ri</) -g ]ji(j]jg(j front of the |1) component of the first qubit: 

|0)|V^) -L(|o) + |l))|V.) = i=(|o)|V;) + |l)|^)) 



1 

71 



(|0) + e2-^|l))|V^). 



The second stage is to apply the Hadamard transform to the first qubit in order to make the 
phase an observable quantity in the standard basis: 



1 



(|0) + e2-^<^|l))|V') ^ ((l + e2-<^)|0) + (l-e2-'^)|l)) 



72"-' ■ ' 2 
The outcome '0' is observed with probability 



1 e^'^^'^ 



1 



'1 -|- cos 27r(/) -|- i sin 27r(/))| = cos^ vri/). 



(4.5) 



Accordingly, the outcome '1' is observed with probability Pi = 1 — Pq = sin'^ tt^. The whole 
procedure is often modelled by a diagram shown in the Figure 4.2 The gate represents a 
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U 



Figure 4.2: Schematic diagram of the eigenvalue kick-back circuit. 

phase shift caused by some physical process and maps a prescribed single qubit state |0) + 11) 
to |0) + e2'^*<^|l). 

The question is now how to determine the phase in the most efficient way. By repeating the 
simple eigenvalue kick-back procedure M-times, Pq and consequently (j) can be determined 
to an accuracy of 1/\/M. This result follows from the central limit theorem: for large Af 
the error on average decreases as A/^/M, where is the variance of the measurement 
results associated to the physical apparatus. Thus one needs go to through at least M ~ 2^*" 
independent rounds to obtain m accurate binary digits of (f). The scaling 1/\/M is known 
as the standard quantum limit (SQL). However, using an advanced setup, the scaling may 
be improved up to 1/M (the Heisenberg limit). Giovannetti et. al. |73| showed that after 
employing the phase shift Uff, at total M-times the scaling 1/M is the general lower bound to 



the estimation error. A setup which achieves the Heisenberg limit is shown in the Figure 4.3 



This setup with a register of ancillary qubits exploits namely a sequential applying of the 
phase shift to the same qubit. Dam et. al. |74J proved that this scheme is indeed optimal. 



(Uo)' 



u 



Figure 4.3: Advanced setup for the phase estimation. 



4.2.2 Advanced scheme for phase estimation 



The algorithm based on the powers of the phase shift is called the phase estimation algorithm 
(PEA). The PEA was for the first time used by Kitaev [5l] in his work on the abelian stabilizer 
problem and the modern formulation of the PEA based on the quantum Fourier transform is 
due to Cleve et. al. [75]. The phase estimation problem itself is defined as follows. 



Definition 4.2.1 (Phase estimation problem). Let [/ be a 2" x 2" unitary transform. Let 
IV'i)) iV's), • • • 5 denote eigenvectors of U with corresponding eigenvalues Ai, A2, . . . , A2", 
where Aj is of the form e^'^*'^^ , i.e.. 



U 
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Given a set of black-boxes (oracles) capable of preparing a particular eigenstate \^p) and 
performing the controlled- [/^ operation for /c = 0, 1, 2, . . . , m — 1, efficiently determine phase 
^ G [0, 1) to the precision of order 1/2™ with reasonable high probability. □ 



A proof that the advanced scheme (Figure 4.3) for phase estimation reaches the Heisenberg 



limit follows. Right before the measurement the state of m ancillary qubits can be described 
as: 



1 



/2m 
1 

1 



2 



/=m— 1 
2 



(4.6) 



^2iTik<f) I 



l=m—l 
2™--l 



k=0 



k=0 



In order to prepare this superposition, the phase shift has been employed X^I^o^ — 
2"* — 1 = 2'"-times. Now, the essential role of the (inverse) quantum Fourier transform is the 
ability to perform the transformation 



2™-l 



(4.7) 



fc=0 



where j is a non-negative integer and j/2™' is a good estimator for (p with high probability. 
Let us use the following notation: 

y/Orn Z — / 
^ fc=0 

2^-1 

/2~ 



and 



QFT^ : 



/om ^ 



(4.8) 
(4.9) 



Then, 



2™-! 



2^-1 



om \ . /om <■ 



-2-Kikj/2" 



\3) 



3=0 



^ k=0 

2^-12™--! 

_L V V e2'^^^(<^-^'/2'") 

2m / ^ / ^ 

fe=o i=o 

2'm_i 2™-l 



j) (change the order of sums) 



^ > ( om 



,27rjfc(0-j/2™) 



(4.10) 
(4.11) 
(4.12) 



j=0 



k=0 
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Therefore the probabihty to measure a particular outcome j is 



Pj 



2™-l 



k=0 



Figure 4.4 shows the output probabihty distribution for m = 3 and various 



(4.13) 
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Figure 4.4: Output probabihty distribution for m = 3 and various 



In order to analyze (Eq. 4.13 ) and to understand the Figure 
where 6 



4.4 



let us write 6 as 



+ 6 2- 



0.(/)i(/>2 . . . (pm denotes the first m bits of the binary expansion and < 5 < 1 is 
a remainder. A special case where 6 = means that (p has a binary expansion with no more 
then m bits, i.e. cj) = cj) = for some j G {0, 1, . . . , 2"^ — 1}. Given (5 = 0, the probability 
of observing j such that j/2''" = is 

2 „™ , 2 



2™-l 



k=0 



2™-! 



-El 



k=0 



1. 



(4.14) 



Thus the Fourier transform deterministically reveals the exact phase in this case. In other 
cases, < 6 < 1, the best we can hope for is to observe 



J 



such that 



• = 0.(j)i(j)2 



(rounding down) 
(rounding up) , 



such that i/2™ 

with sufficiently large probability. Both estimates (j) and + 2^™" guarantee error smaller then 



1/2"^. Figure 4.5 details the situation. 



To determine the lower bound of the probability to observe either (j) or (j) + 2 ™', we simplify 



(Eq. 4.13) using the formula for the sum of a geometric series and trigonometric identities: 



Pj 



E 

fe=0 



,27rifc((/)~j72™) 



1 

22m 



„27rj(2'-</.-i) 



p27ri(0-jr72™) 



1 sin2(7r(2'^(/)-j)) 
22^sin2(7r((/)-j/2™)) 



. (4.15) 
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Figure 4.5: Two closest estimators of the phase 
Using the substitution cj) = (f) + (52~™, we get 



1 sin^ (vrJ) 
22^sin2 (7r52-" 



(4.16) 



and 



(4.17) 



The total probability is then P = Pdown + -Pup- Corresponding function plots for < (5 < 1 



and m = 10 are shown in the Figure 4.6 
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Figure 4.6: Success probability of observing a good estimator. 



The success probability P decreases monotonically for increasing m and in the limit m — > oo, 
the lower bound is 



P(5 = 1/2) = Pdo^^{b = 1/2) + P„p(5 = 1/2) = A + ^ > 0.81. 



(4.18) 
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Here, I provide sketch of a simple proof which is conceptually different from the conventional 
proof based on the ratio of the minor arc length to the chord length |H [75] . 



5 > sin(5) , for < 6 , (follows from the Taylor series of sin 5) (4.19a) 
Tr5 > sin(7r5) , (4.19b) 

>sinf^), for m = 0,1, 2,... (4.19c) 



2m \2 



/ tt5 



^5>2-sin^— ), (4.19d) 



, , , sin(7r5) \ sin^(7r(5) sin^(^ 4 
Pdon,n{0 < 6 < 1/2 = ^-j^ > ] ' > = , 4.20 

2'"sin(#W i^-^) (2) ^ 



2" 




2 

2 Q;n2 /TT^ 



2 



□ 



In conclusion, the advanced scheme (Figure 4.3) can be used to determine the phase with 
precision of order 1/2™ after the phase shift has been used at total 2™ times. Thus the 
advanced scheme reaches the Heisenberg limit. In particular, the accuracy of order 1/2"* is 
reached with a success probability > 0.81 independently of m. 

In contexts where a higher probability of success is desirable, the success probability can be 
amplified to 1 — e for any e > by inflating m to m' = m + 0(log(^)) and keeping only m 
most significant bits. For a proof see Cleve et. al. |75j. A different approach, which avoids 
implementing U for A; > m, is to repeat the whole procedure a number of times, choosing 
the most frequent result. 



4.2.3 Efficient circuit for the quantum Fourier transform 



The next step in the search for efficient algorithms solving instances of the phase estimation 
problem is to find an efficient circuit for the quantum Fourier transform over Z2m. An 
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approach which is essentially the inverse of the derivation used in (Eq. 4.6) leads us to 

/2m 



QFT : |j) ^ e^-^^^l^ 



k=0 

2™-l 



1 27Tij( Y: fci2™-M/2™ 

■= > e ^'=1 

/2m / — ^ 



k = Y,ki2"'~\ ke {0,1}, (4.22) 

m 

)=l^\ki), (4.23) 

■•• 5^ |A:i,A;2,...,A;™> (4.24) 



1 



fc=0 

1 



1=1 



M = 2" 



2-Kij E fci 2- 



fci=0 km=0 

1 1 



fcl=0 km=0 



(4.25) 



/A/ 



^ ... ^ g27riifci2-lg27rjjfc22-2 




fci=0 A;m=0 




1 1 m 












1 1 m-1 








ki=0 km=0 1 = 1 




1 1 m-1 








ki=0 k,„-i=0 1=1 
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m 1 




(g)^g2..,7c.2-|^^^ 





1=1 ki=0 



^ m 



27rij(0)2-'|Q^ _^ g27rii(l)2-'|-,^^^ 
27rij2-'|-|^jj' 



|0)+e2^^°-^"|l))(|0) + e 



^2-niO.jm-ijn 



|1) ••• |0)+e 



^2m0.jij2...j n 



|1) 



(4.26) 
(4.27) 
(4.28) 
(4.29) 
(4.30) 
(4.31) 

(4.32) 
(4.33) 



Let us write the input state \j) in the tensor product form |j) = ji G {0, 1}. Then 



the first factor in (Eq. 4.33) can be prepared via the Hadamard transform applied to the state 

\jm)- 

H\3ra) = 4^(|0) + (-1)^™|1)) = 4^(|0) + e^-O-^-ll)) (4.34) 



To prepare the second factor in (Eq. 4.33) we need a gate capable of adjusting the relative 
phase. A suitable gate is a z-rotation gate 



Rk 



1 
e^-Zs'^ ) • 



(4.35) 
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By applying the Hadamard transform and the gate R2 conditioned on the bit jm to the state 
\jm-i) we get 



R?^^H\jm-i) = i^^a^^dO) + e2'^^°-^™-i|l)) = ^=(10) + e^^O-^— ^ e^^i3^/^''\i)) 
\/2 \/2 



1 

71 



(|0) + e2^^°-^— 



(4.36) 



The other factors can be prepared accordingly. The corresponding circuit, derived from the 



product representation (Eq. 4.33), for the quantum Fourier transform over Z2'" is shown in 



the Figure 4.7 Note that the order of qubits becomes reversed and swap gates should be 
used if needed. 
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Figure 4.7: Efficient circuit for the quantum Fourier transform over Z2" 



The circuit utilizes (m^ + m)/2 = 0{rn?) gates. An obvious bottleneck is that some of these 
gate require an exponential precision up to = 1/2™. By the Solovay-Kitaev theorem, each 
such gate will require 0(log'^(l/^)) = 0{mP), where c ~ 4, gates from a fixed universal set. 
This implies an efficient circuit, however, the corresponding polynomial is of unacceptable 
degree. Barenco et. al. [7^ studied approximated quantum Fourier transform (AQFT) 
where gates for k > log2 m + 2 (i.e. a logarithmic-depth AQFT) are neglected and showed 
that the accuracy of the QFT can be achieved after 0((m/logm)'^) iterations of the AQFT. 
D. Cheung [77] improved significantly on this result and showed that the output probability 
distribution of a single logarithmic-depth AQFT iteration is in fact very close to the QFT 
output distribution. In particular, Cheung gave a lower bound 

4 1 

Pdown,up\^ — -^/^) — 9 ~A ) 

vr^ 4m 

for m > 4. Therefore the logarithmic-depth AQFT can be considered a direct replacement 
for the QFT. The amount of Rk gates is now 0(m log m) and the desired gate accuracy is 
^ = 1/2'°^™'. Using the Solovay-Kitaev theorem, only 0(m log mlog'^m) = 0{m'^) gates 
from a fixed universal set are required in order to implement that transform. 

The history of efficient circuits for a quantum Fourier transform goes back to D. Deutsch. 
In 1989, Deutsch [22] described an efficient circuit for QFT over Z™, that is the Hadamard 
transform. Shor fT2] inspired by the Simon promise problem [161, where the Hadamard 
transform was used, realized how to efficiently implement QFT over the group Zg for certain 
special values of q. In 1994, D. Coppersmith improved this result to hold for Z2™ and 
one year later Kitaev [SI] gave an efficient circuit for a quantum Fourier transform over an 
arbitrary finite abelian group. Somewhat later, human-competitive circuits for QFT (and 
other transforms) were also discovered using genetic programming [751 E2] • 
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4.2.4 Linear property of the advanced scheme 



Details of the advanced scheme for phase estimation including the efficient measurement in 
the Fourier basis (implemented by the Fourier transform + projection onto the computational 



basis) is shown in the Figure 4.8 
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Figure 4.8: Detailed scheme for advanced phase estimation. The state {ip) is promised to be 
an eigenstate of U with an eigenvalue e^'^*'^. The output given by X^^x 3k 2"^^ = is a 

good estimate of (p, \(j) — j/2'"| < 1/2™", with high probability. 

Essentially the scheme transforms the input state \0,ip) in the following way: 

10,-0) (4.37a) 



/2™ . 



controlled- (7^ 



El^' U'^) = TP E ^'^'■^■'1^' ^) (4.37c) 
3 i 

(4.37d) 



where states |j, "0) such that |0 — j'/2'"| < 1/2™ have dominating probabilities \oLj\ and 
thus one of them is observed with high probability. Therefore the overall transform can be 
described as 

1^ phase estimation i , ,v i, nr,\ 

\^,^\)) ^^►,V'), (4.38) 

where denotes a good estimator. Importantly, since [/ is a linear operator, the same 

concept applies to an input superposition of eigenvectors of U . Thus we can avoid preparing 
a (possibly unknown) eigenstate, at the cost of introducing some additional randomness into 
the scheme. 

Let I?) = X^gTslV's) denote an arbitrary quantum state expanded in terms of eigenstates IV's) 
of U. Then 

1^ , \ ^ |„ , , phase estimation \ ^ , , , , 

|0,?) = 2^ 75 10,^^5) 2^7,H</., (4.39) 

s s 

where M (ps ^ denotes a good estimator related to the eigenstate \ips)- A subsequent mea- 
surement on the first register yields one estimator < (pg ^ chosen at random with probability 
1 7s p. An important side effect of the measurement is a collapse of the second register to the 
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corresponding eigenvector (or a superposition of eigenvectors related to a particular degenera- 
tive eigenvalue). Therefore the phase estimation scheme can be used to prepare eigenstate(s). 
Note that the eigenstate remains unknown to us. 



4.2.5 Representative instances of the phase estimation problem 
4.2.5.1 Factoring casted as a phase estimation problem 

Kitaev |54 | I21] showed that the order finding algorithm (the only quantum part of the factoring 
algorithm) is equivalent to the scheme where we estimate an eigenvalue of the unitary operator 
U given by 'modular multiplication by k^: 



U ■.\y) — >\ky (mod N)) . 



(4.40) 



Let r denote the unknown order, i.e. the least positive integer such that k'^ = 1 (mod N) for 
given coprimes k and A^. The main observation done by Kitaev is that states defined as 

r-1 

IV's) = e-2-^jV'^|A:J' (mod TV)), (4.41) 

V j=0 

for integer < s < r — 1 are eigenstates of U. Additionally, since W^ly) = \k'^ y (mod N)) = 
\y) and thus C/'" = /, the eigenvalues of U must be of the form = e^'^'^^l'^ . We can verify 
that 

r-1 

C/|^,) = y e-2^*J'^A|A;J'+i (mod N)) = e^^^^/nV's) = AJ-fAs) • (4.42) 
It is also useful to rewrite (Eq. 4.41 ) in the form 



1 """^ 

y-g2^iiVn^ \ = \k^ (mod N)) 



s=0 



and by setting j = to derive 



r-1 



ID. 



(4.43) 



(4.44) 



s=0 



Thus the state |1) trivially constitutes an equally weighted superposition of eigenstates iV's)- 

The process of a phase estimation applied to the 'modular multiplication by V operator U 
can be described as follows. 



|0)|1) 



controlled- 1/-' 



2™-l 



2™-l 

2™-l r-1 
^ o— n V „_n 



(4.45a) 
(4.45b) 



2'"-l 



/L (modiV)) (4.45c) 

(4.45d) 



i=o 
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2'"-l r-1 



= Elj-)(4E^'^^^'^nV'.>) (4.45e) 



^ ^ 2'"-! r-1 



r-1 



E E^'"''^ni>iV's> (4.45f) 



1 

s/^^ (4.45g) 

* s=0 



Given the outcome o = s/r ► for some s, the continued fractions algorithm efficiently pro- 
duces numbers s' and r' with no common factor, such that s' /r' = s/r. For m = 0(log(A^^)) 
the number r' is equal to the order r with high probability. 

Efficient implementation of cont rolled- ?7^' gates 

In order for the period finding algorithm to be practically useful, we need to make sure that 
all its steps are performed efficiently with respect to the size of the input m = 0(log(A^^)). 
So far we know that initialization of the input state to |0)|1) is efficient, measurement in the 
Fourier basis is efficient and the classical postprocessing is efficient. The implementation of 
the controlled-t/^ gates, where < ^ < m — 1, based on the repeated modular squaring can 
be performed efficiently as well. Naive implementation consisting only of repeated application 
of the controlled-C/ gate is obviously not efficient with respect to m. 

Let us have gates for modular multiplication and modular squaring (these are manifestly 
efficient): 

Umui '■ I a) I ft) — > |a)|a6 (mod N)), (modular multiplication) (4.46) 

U2 ■ \a) — > (mod N)) . (modular squaring) (4.47) 

The implementation of the controlled- C/^' gate based on the modular squaring consists of four 
steps: 

1. Prepare two registers. The first is a scratch register initially set to \k). The second 
register contains an arbitrary state \y). 

2. Apply the squaring gate /-times to the scratch register. 

\k, y) l/c^ (mod N), y) \k'^ (mod N),y) > \k'^' (mod TV), y) (4.48) 



3. Conditioned on some bit ji perform the modular multiplication. 

\k^' (mod iV), y) — > \k'^' (mod iV), k^' y (mod N)) (4.49) 

4. Set the scratch register to \k) again, so it can be reused. This can be performed either 
by 'uncomputing' or a measurement based reset operation. 



The procedure is shown in the Figure 



4.9 
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Figure 4.9: Efficient implementation of the controlled- [/^' gate, where U performs a modular 
multiplication by k. 



4.2.5.2 Finding the energy eigenvalues of a local Hamiltonian 

In 1982, R. P. Feynman suggested that a quantum computer might be capable of an efficient 
simulation of other quantum physical systems [80]. S. Lloyd [19] showed that an efficient 
simulation is indeed possible at least for quantum systems with a local Hamiltonian. Systems 
with a local Hamiltonian capture a large part of relevant physics. The question then arises, 
what kind of properties can be efficiently extracted from the simulation. Abrams and Lloyd 
[HI] focused on static properties and showed that the phase estimation procedure can be used 
to find efficiently the energy eigenvalues if approximate eigenvectors are available. 

Let W be a (local) Hamiltonian with energy eigenvalues and eigenstates \ips)- This Hamil- 
tonian generates a unitary evolution U = e~*^* during time t. Energy eigenvalues are mapped 
to the phase of eigenvalues of U . 

n = J2^M{Al U = e-*^* = ^e-^^=*|V',)(V^,| =Y^e^^'^^\i^s){A\ • (4.50) 

s s s 

Let I?) denote a promised approximate eigenvector Itp). In general, accessing an approximate 
eigenvector is a very hard problem |82| 155] . Therefore the Abrams-Lloyd algorithm is in 
practice limited to cases where a rough approximate eigenvector can be efficiently obtained by 
classical 'ab initio' methods which result in a known wave function [HT]. Another possibility is 
to exploit the adiabatic state preparation procedure |84| 185] . However, the power of adiabatic 
state preparation is yet not fully explored and its further study will determine the usefulness 
of the Abrams-Lloyd algorithm. 

The phase estimation scheme applied to the operator U and an approximate eigenvector |<;") 
reveals a good estimator of the phase (p with a probability The corresponding energy 

eigenvalue is then calculated as 

A = 27r(l - 0)/t. (4.51) 

Clearly, time t should be chosen such that <j) ~ 1/2 in order to avoid a long sequence of 
initial zeroes in the binary expansion of (p. A satisfying value for time t can be calculated 
using classical approximation methods for rough estimates of A. The dependence on a rough 
estimate of A is not that limiting as the dependence on an approximate eigenvector. Potential 
initial zeroes contribute to the overall complexity of the algorithm as a (large) hidden constant. 

The scheme for phase estimation as proposed by Abrams and Lloyd |81j is shown in the 



Figure 4.10 This scheme is functionally identical with the scheme in the Figure 4.8 The 
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only difference is tliat an additional quantum logic is used to determine how many times 
should be a controUed-C/ gate applied to a particular ancilla qubit ji in order to implement 
a controlled-C/^ gate. This is intentional in order to stress that the controlled- [/^ gates can 
be implemented only by a long sequences of applications of a plain controlled-?/ gate. There 
is no shortcut similar to the one used in the period finding algorithm. 
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Figure 4.10: The phase estimation scheme of Abrams and Lloyd. 



Assuming access to an approximate eigenvector and an efficient implementation of U (and 
controlled-C/ consequently) with respect to the size of the problem n (size of the system being 
simulated), the algorithm for finding energy eigenvalues and preparing eigenstates performs 
as follows. The scheme operates at the Heisenberg limit and therefore the accuracy of order 
1/2™ implies at most 2"^ employments of the controUed-C/ gate. The number m is the amount 
of ancillary qubits which are measured. In practice, the precision is a fixed parameter and 
amounts to the overall complexity as a hidden constant. For example, quantum chemistry 
|85) requires m ~ 20. This is in sharp contrast with the order finding algorithm where the 
size of the ancilla register scales with the size of the problem (order of few thousands of 
qubits for breaking the RSA public-key cryptography). Considering m a fixed parameter, 
the algorithm is efficient by virtue of an efficient circuit performing the controUed-C/ gate. A 
quantum simulation with n > 30 outperforms classical computers dramatically. 



Efficient simulation of quantum systems with a local Hamiltonian 

A local Hamiltonian describing dynamics of a quantum system with n particles can be written 
as a sum over many local interactions 

L 

n = Y,'Hk, (4.52) 
fc=i 

where TCk acts on at most a constant number of particles, and L is a polynomial in n. The 
key to quantum simulation algorithms is the convergence of the Trotter formula which allows 
to approximate the evolution 

U = e"^^* . (4.53) 



68 



CHAPTER 4. PHASE ESTIMATION AND APPLICATIONS 



An exact simulation is not possible since the different do not have to commute with each 
other. Therefore, the direct approach 



(4.54) 



is not correct. 

Theorem 4.2.1 (Trotter formula). Let A and B he hermitian operators, then for any real t, 

(4.55) 
□ 



hm (e^At/g^^Bt/gy ^^iiA+B)t^ 
5— >oo 



By the definition of a matrix exponentiation and for some 6 < 1, we have 

= 1 -i{na + nb)5 + 0{5^), 

and 



The asymptotic equations (4.57) and (4.58) permit us to write 



(4.56) 
(4.57) 

(4.58) 
(4.59) 



Now, the equation (4.59) and the convergence of the Trotter formula allow us to perform the 



whole simulation by simulating the local evolution operators over short discrete time slices 
and then repeat the sequence of these local simulations a couple of times. In particular, for 
q>t, 



-i(Hi+n2+-+nL)t 



,-ini{t/q)-in2{t/q) 



. e 



-iHUt/q) 



+ 0(q{t/qy 



(4.60) 
(4.61) 



Therefore by choosing q > (t'^/e), we can implement the evolution U = e~'^*, where is a 
sum over local interactions, TL = X^fc^i^fc, within error tolerance of 0{e) using 0{L{t^/e)) 
'basic' gates of the form e"*^*^^*/*^^. Since L is polynomial in the size of the problem n and 
TLk acts on at most a constant number of particles, the whole simulation requires an amount 
of gates of order 

o(poly{n)^-), (4.62) 

and thus is efficient. 



A similar result is known for Hamiltonians of the form Ti = ^^^i (^p(k)^ where a"p(fc) are Pauli 
matrices. 
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4.3 Iterative phase estimation algorithm - IPEA 



4.3.1 Motivation 



The Abrams-Lloyd algorithm is potentially the most important quantum algorithm known 
so far. Even a small quantum computer with as many as 100 qubits at total is expected 
to outperform any classical computer in certain scopes of quantum chemistry calculations. 
The issue of a relevance of a small quantum computer for real chemistry problems has been 
recently studied by Aspuru-Guzik et. al. [85]. In the work, the authors carried out a modified 
phase estimation scheme where the size of the ancilla register is fixed and a high accuracy of 
order 1/2™ is achieved via m iterations of the scheme. Using this scheme and an adiabatic 
state preparation, simulated calculations of the water and lithium hydride molecular ground- 
state energies were performed. This required only 8 and 11 qubits for storing an approximate 
eigenvector (the molecular ground-state wave function) and four qubits in the fixed-size ancilla 
register. These simulations strengthened the conjecture of Abrams and Lloyd that quantum 
computers of tens to hundreds of qubits can match and exceed classical calculations. The 
A;-th iteration of the Aspuru-Guzik scheme for phase estimation (recursively defined iterative 



PEA) is shown in the Figure 4.11 
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Figure 4.11: The Aspuru-Guzik phase estimation scheme. 



In the first iteration the operator Vi is set to U, where U simulates the evolution of some 
physical system. The input state {ip) is promised to be an eigenstate of U with an eigenvalue 
g27ri(/)_ (;ig]2ote the binary expansion of i;^> as ip = 0.(j)i(/)2cl)3 ■ . .. The result of the first 

iteration is a four bit estimate ipi of the unknown phase (p. With high probability this estimate 
is accurate at least in order of 1/2. The estimate ipi enters the next iteration with the operator 
V2 = e^^'^**-^'^^''[/^. The phase shift in the operator V2 effectively enables to measure a four 
bit estimate ip2 of a phase (2(0 — ipi) mod 1) = {0.(j)24>34'i4'5 ■ ■ ■ ~ O.x^^^ x^^^ x^^^). Now, the 
number {(pi + V'2/2) constitutes an estimate of (f) which is accurate at least in order of 1/4 
with high probability. Analogically, each additional iteration yields one more bit of (j). In the 
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k-th iteration, we work with a phase 
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(4.63) 

measure a corresponding estimate (p^, and the final estimate of (j) accurate to at least m binary 
digits is given by 



(4.64) 



k=l 



In conclusion, the Aspuru-Guzik scheme requires 0{m) iterations, 0(4m) = 0{m) measure- 
ments, and the plain controlled-U gate is employed 0(2"'"'"^) = 0(2™) times in order to create 
required operators controlled- V^^ for c = 1,2,4,8. 

Example 9 (Aspuru-Guzik phase estimation). 

Let (j) = 0.011101101 .... The progress of obtaining gradually more accurate estimates of (j) is 
captured in the following table. 



iteration k 


working phase 


result ifk 


final estimate 


1 


0.011101101 . . . 


0.0111 


0.0111 0.1 


2 


0.00001101... 


0.0001 


0.01111 0.10 


3 


0.1111101... 


0.0000 


0.011110 ^ 0.100 



Table 4.1: Sample run of the Aspuru-Guzik phase estimation. 



□ 



Another scheme for phase estimation which can be performed in an iterative manner with a 
fixed-sized ancilla register is the original procedure used by Kitaev in |54| . Let (j) denote the 
unknown phase of an eigenvalue e^'"^'^ related to some unitary operator U and its eigenstate 
l^^). Kitaev observed that if one knows estimates of the numbers 2^~^(f) (mod 1), for k = 
1,2, .. .m, then there exists a polynomial classical algorithm which can reconstruct cj) to at 
least m binary digits. The circuit which determines an estimate of 2^^^(f) (mod 1) is shown 



in the Figure 4.12 



|o) -\h 



H 



Figure 4.12: Kitaev's phase estimation circuit. 



The outcome Xk = is observed with probability Pq = cos^(7r2'^ ^C/ 
probabihty that = 1 is Pi = 1 - Pq = sin^(7r 2^""^^). See Figure 4.13 



Accordingly, the 
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Figure 4.13: A plot of outcome probabilities in the Kitaev PEA. 



Exploiting independent trials of the circuit and using the Chernoff bound, it is possible to 
determine whether 2^0 (mod 1) is closer to zero ("0.0"), i.e. Pq > Pi, or to one half ("0.1") 
with error probability < Sk after 0(log(l/efc)) trials. By setting < e/m, all the values Xk, 
for k = 0,1, . . . ,m — 1, can be correctly determined with error probability < e. Therefore 
this scheme requires at total 0(mlog(m/e)) iterations (measurements) for estimating to m 
binary digits. The plain controUed-U gate is employed 0(2™ log(m/e)) times at total in order 
to implement required operators controlled- [/ . 

Compared to the Aspuru-Guzik scheme, the Kitaev phase estimation is asymptotically slower 
by a small logarithmic factor. However, in the context of estimating energy eigenvalues where 
m is a fixed constant between 20 and 30, the performance of the Kitaev algorithm is actually 
better. Besides, it requires only a single ancillary qubit and the circuit is easier to implement. 

The question arises, whether there exists an iterative scheme for phase estimation (IPEA) 
which does not contain the logarithmic factor (reaches the true Heisenberg limit) and utilizes 
only a single ancilla qubit. Such a scheme would be of utmost importance for experimental 
implementation with a very limited number of qubits. The answer is yes and such a scheme 
can be derived from the textbook (QFT-based) phase estimation (Figure 4.8). The derivation 
requires knowledge of how the entanglement is localized in the circuit and understanding of 
the information flow in the measurement in the Fourier basis. In particular, the key point is 
a discovery of an adaptive implementation of the measurement in the Fourier basis (so called 
semiclassical QFT) by Griffiths and Niu [86^ . The relevance of incorporating the semiclassical 
QFT into the Shor's circuit for factoring was first noticed by C. Zalka [87], then by Mosca 
and Ekert [88] in the context of solving the hidden subgroup problem by means of the phase 
estimation approach, and by Childs et. al. [89] for distinguishing Hamiltonians in some cases. 

Regarding the problem of finding energy eigenvalues, Abrams and Lloyd [81^ and Aspuru- 
Guzik et. al. [85\ do not employ IPEA although parts of their respective works focus on 
a relevance of the algorithm for a quantum computer with a very limited amount of qubits. 
Properties of the IPEA in the context of finding energy eigenvalues have been recently studied 
by Knill et. al. ^ and Dobsfcek et. al. jX^]- 
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4.3.2 IPEA derived from the Kitaev phase estimation 



In contrast to the QFT-based PEA (Figure |48|) , the Kitaev PEA (Figure 4.12) does not ex- 



phcitly use the quantum Fourier transform as such. Therefore, in some sense, the Kitaev PEA 
allows to solve abelian HSP-like problems without using the relatively extensive knowledge 
behind quantum Fourier sampling. Moreover, it is possible to derive the IPEA scheme from 
the Kitaev PEA by incorporating a classical postprocessing algorithm used to construct the 
estimate < cp >■ into the quantum circuit. Such a result may be quite inspiring in the further 
development of quantum algorithms as the usual approach is to perform as much as possible 
of necessary calculations classically, since quantum resources are considered 'expensive'. 

There are many possible efficient classical algorithms suitable for postprocessing in the Kitaev 
PEA (no specific algorithm was given by Kitaev in [53] ) • I propose to use an algorithm which 
can be described as a weighted interval intersection method. The core of this method is 
outlined in the Figure 4.14 To each of the results is assigned an interval with a weight 1 /2''. 

xi = 



X2 



X3 







Figure 4.14: A weighted interval intersection method as a postprocessing algorithm for the 
Kitaev PEA. In general, there are two candidate estimates and an intersection with additional 
shifted weight-1/2 interval determines the final estimate. The figure shows a sample run for 
(p = 0.110110 . . . which gives the following estimates xj^ for values of 2^~^(j) (mod 1): xi = 0, 
X2 = 1, and X3 = 1. 

The weight also determines the spanning range of the interval. By making intersections of the 
two largest intervals per step, we end up with two small intervals of size 1/2™'"'"^ after m — 1 
steps. Let us associate a candidate estimate < (j)^^^ ► to the value in the center of one of the 
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two small intervals. This ensures that the candidate contains information sufficient to reveal 
^ to m + 2 binary digits. Accordingly, there is a second candidate < (j)^'^^ >■=!—< 0*-^^ ►. 
The last step is to decide which candidate is the right one. We perform one more intersection 
with an interval assigned to the outcome x'^ of an additional iteration of the Kitaev scheme 
where to the phase 2TT(j) (contained in the ancilla qubit) is added a phase 27r(0.01). A circuit 



corresponding to this additional iteration is shown in the Figure 4.15 



|0) 



i2^(27r(0.01)) 



H 



= Xi 



U 



Figure 4.15: Additional iteration in the Kitaev PEA. 



An important observation from the Figure 4.14 is that an interval with the smallest weight 
imposes the largest constraints to the spanning range of the other intervals. In other words, 
an interval with a small weight, if determined at first, can help to keep the spanning range of 
other intervals small. While this is not a good classical strategy (there are too many small 
ranges to keep track of), nothing prevent us to obtain the least significant bit Xm at first and 
use this information to improve the search for the bit Xm-\ in the quantum circuit. This is a 
sort of feedback improvement similar to the one used in the Aspuru-Guzik scheme. 

Let us write (p as (j) = (f) + 62~"^, where <j) = 0.(pi<j32 ■ ■ ■ <Pm. denotes the first m bits of the binary 
expansion and < 5 < 1 is a reminder. In order to determine the bit (f)m, we perform an 
iteration of the Kitaev PEA for k = m, i.e. the gate controlled- ^7^™ is used. A single trial 
gives us the probability Pq = cos'^ {Tr{0. (j)m + 5/2)) to measure Xm = and the probability 
Pi = sin^(7r(0.(/)m + <^/2)) to measure Xm = 1- Thus for 



Po = cos2(7r(5/2). 

Pi = sin2(7r/2 + 115/2) = cos'^{'k5/2) 



and therefore 



cos2(7r^/2) . 



(4.65) 



(4.66) 



In the next iteration of the Kitaev PEA, k = m — 1, the phase of the ancilla qubit 
is 27r(O.0 m-i4>m. + '^/4). Assuming we know the bit (j)m, we can perform a Z rotation 
with angle com-i = — 27r(0.0xm). Then the conditional measurement probability becomes 
Pq = cos2(7r(O.0m-iO + (5/4) and 



Pm-l = P{Xm^i = I Xm = (pm) = COS^(7r(5/4) 



(4.67) 



Note that Pm—i is significantly larger than Pm- Accordingly, we use bits Xm and Xm—i to 
improve the probability that Xm-2 will be equal to 0m- 2- The k-ih. iteration of this IPEA is 
shown in the Figure 4.16 Generally, using the feedback angle ujk = — 27r(0.0a;fc+ia;fc+2 . ■ . Xm) 
the conditional probability P^ for a bit x^ to be equal to (pk is 



Pfc = cos'(7r2'=-i(52-'")). 



(4.68) 



Note that the equation (4.68) shows an exponential increase of Pk with decreasing k. The 
overall probability for the IPEA to extract (j) = 0.(pi(j)2 . . . • 



i.e. an m-bit rounded down 
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|o) -{h 



H 



Figure 4.16: The k-th iteration of the iterative phase estimation (IPEA). The feedback angle 
depends on the previously measured bits through = — 27r(0.0xfc+iXfc_|_2 • . . Xm), and tOm = 0. 
Note that k is iterated backwards from m to 1. 



estimate of (p, is then 
Pd own 

(0 < (5 < 1) = PmPm-l 



= fJcos2(7r2'=-i(()"2-™)) 



(4.69) 



sin^(7r(5) 



using the trigonometric identity 



m— 1 



Yl cos(2'^a) 



fc=0 



sin(2™a) 
2™sin(a) 



for 5 = 0, 
for < 5 < 1 



(4.70) 



for a 7^ 0. Using a similar derivation, the probability to extract (p + 2 

sin2(^(l - ,5)) 



PupiO <6<1) 



22msin2(vr(l - 5)2-"^) 



(4.71) 

(rounding up) is 

(4.72) 



Equations ( |4.70[ ) and (|4.72|) are identical to the QFT-based PEA equations (|4.16|) and (|4.17|), 
respectively, see page 



59 



Therefore, the IPEA shares with the QFT-based PEA the same 
lower bound on the probability to observe an estimate of <j) accurate to at least m binary 
digits with error probability e < 1 — S/vr^. In conclusion, the IPEA requires 0{m) iterations 
(measurements) in order to achieve the precision of order 1/2*" and the plain controUed-C/ 
gate is employed 0(2™) times. Thus the true Heisenberg limit is achieved utilizing only a 
single ancilla qubit. 

Similarly to the QFT-based PEA, success probability can by amplified up to 1 — e for e > 
by extracting m! = m -|- 0(log(l/e)) bits and keeping only m most significant ones. However, 
this approach is not favorable with respect to the costs of implementing gates controlled-C/^'° 
for k > m. The plain controlled-?/ gate would be needed 



(4.73) 



times. Per bit repetitions and majority voting is a better option. First, we observe that the 
bare bitwise error probability 



I - Pk = sm\^2^-\52-"')) 



(4.74) 



decreases exponentially with decreasing k. This implies that only logarithmically many least 
significant bits have non- negligible error probabilities 1 — P^; see Figure 4.17 
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0.35 p 
0.3 - 




Figure 4.17: Bitwise error probabilities sm^{7T2^-^ {62~"')) for m = 30 and 6 = 3/8. 

Additionally, the probability of a bit Xk to be correctly determined after Nk independent 
trials is 

Pk= tl (^'){Pkf'~'{l-Pkr, (4.75) 

s=0 ^ ^ ^ 

given that Xk is chosen using majority voting from the results. Thus the effective error 
probability decreases exponentially with the number of repetitions, according to the binomial 
distribution. Therefore repeating the iterations for the 0(log(l/e)) least significant bits an 
0(log(l/e)) number of times gives an error probability smaller than e, independently of m. 
The total amount of iterations (measurements) then goes like 0(m + log^(l/e)) and the plain 
controlled-L'^ gate is utilized 

m riog(l/£)l 

5^2^-1 + riog(l/e)l Yl 2"-* = 0(2™log(l/e)) (4.76) 

k=l t=l 

times. The scaling 0(2™ log(l/e)) is a consequence of the fact that the least significant 
bits are the most expensive bits in terms of constructing the corresponding controlled gates. 
However, the factor log(l/e) is more pleasing than 2'°s(^/^-*. 



4.3.3 QFT-based PEA versus IPEA 



The IPEA can be considered as a direct viable alternative to the QFT-based PEA, especially 
for experimental quantum devices with a very limited amount of qubits. Next to a smaller 
number of qubits the IPEA requires, an additional advantage for experiments is the possibility 
to exchange a long coherence time of an input eigenstate for an input state preparation per 
iteration (and/or repetition). See Figure 4.18[ The possibility of having a choice is valid 



for problems where we work with a particular (approximate) input eigenstate since we can 
prepare this eigenstate for each iteration. 



Thanks to the linear property of any PEA scheme (Eq. 4.39 Section 4.2.4 ) , it is not a problem 



to work with an approximate eigenstate at the cost of some additional randomness, however, 
this randomness now enters (complicates) each iteration. Depending on the quality of the 
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a) Input state preparation per iteration. 
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•^m— 1 



C/2 



C/2 



b) Maintaining the second register during all iterations. 



Figure 4.18: The IPEA and an input eigenstate. 



approximation of the eigenstate, repetitions of each iteration are needed to make sure that the 
measured bit is related to the eigenvalue corresponding to the desired eigenstate. Otherwise, 
we may end up in a situation where we work with a different eigenvalue in each iteration. 

In problems where an eigenstate is completely unknown and a state with special properties 
is used instead (e.g. a weighted superposition of eigenstates in the factoring problem), the 
corresponding register must be maintained during all iterations and repetitions. This is due 
to the fact that each measurement on the ancilla qubit results in a collapse in the second 
register. The resulting 'collapsed' state is unknown to us. 



Optimal quantum circuits for general phase estimation 

The question of finding optimal quantum circuits for general phase estimation has been ad- 
dressed by Dam et. al. |71]. It was shown that the QFT-based PEA is indeed an optimal 
circuit (so are derived iterative schemes) and further optimization with respect to some cost 
function can be done only by optimizing the input state in the ancilla register. A common 
cost function is the window cost function that allows any error smaller than ^: 



Cwi.(t>,^(t>>^) = \^ ^, . (4.77) 
otherwise. 



Minimization of this cost function leads to the ancilla input state 

/2r- 



\ancillaoptw) = -p= ^ li) • (4-78) 

This state is created by the initial Hadamard gates in the default QFT-based PEA setting. 
Since the state is a rather simple product state, the initial Hadamard gate in each IPEA 
iteration serves as well. Thus the QFT-based PEA and the IPEA are capable of producing 
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optimal estimates with respect to the window cost function. Another commonly used cost 
function is the (in)fidelity cost function 

C7H<^,^c/>».)=sin2(^^|^), (4.79) 
and the minimum cost is achieved with the initial state 

The state \ancillaoptp) is derived in fOTl. An important observation is that this state is an 
entangled state. In this case, an analytical calculation shows that the information flow is such 
that it cannot be simulated by the IPEA. This implies that there are cost functions for which 
the IPEA is not able to yield optimal estimates. To which degree entangled ancilla input 
states can be approximated in the IPEA is an open question. 



4.4 IPEA applications 

4.4.1 Iterative phase estimation: A two-qubit test-bed application 

The ability to perform single qubit gates and two-qubit (entangling) gates has been demon- 
strated for all major quantum computation technology candidates such as superconducting 
quantum computation, cavity quantum electro-dynamic computation and ion trap quantum 
computation. Having a very limited amount of not yet reliable qubits, the question is what 
kind of test-bed applications can be performed. For example, five to seven qubits are already 
sufficient to run the smallest instances of Shor's or Grover's algorithms, but experiments with 
only two qubits have been so far limited only to testing Bell's inequality [i)2^^ or doing quan- 
tum state tomography [93 . Phase estimation in its iterative form (IPEA) shows up as a new 
test-bed application with only two qubits. 

Here, I deal with three different simulations of the IPEA applied to a simple Z-rotation 
operator 

rr ( e"^" \ / 6-2^^-^ \ , , 

^ = ( e^" J = ( e-^^ j (^-^^^ 

on a two qubit system. In the simulations, the underlying Hamiltonians 

W,, =S,,X(1) + + + + 7(^(1) ® X(2)) , (XX coupling) (4.82) 

n,, =B^,X^^^ + + B^^X^'^^ + + 7(z(i) ® Z(2)) , (ZZ coupling) (4.83) 

where Bzi^z2^Bx^,x2^1 ^'^^ tunable parameters (absorbing the reduced Planck constant K) and 
Z, X are Pauli matrices, and noise models were chosen with respect to |^94j. The Hamiltonians 
are related to superconducting quantum computation [951. 



The operator (4.81 ) has been identified during analysis as especially suitable since: (1) it is di- 
agonal in the qubit eigenbasis, thus the initial preparation of its eigenstate is straightforward, 
(2) the phase to be measured can be controlled directly, and (3) controlled powers of this gate 
can be done with a very short circuit. These properties allow to keep the complexity of a real 
experiment low and isolate well the performance of single qubit rotations and coupling terms. 
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Simulations with focus on single qubit rotations performance and overall setup 
stability 

In general, any single qubit gate U £ SU{2) can be decomposed to at most three successive 



rotations about two non-parallel axis. Given the form of Hamiltonians (4.82) and (4.831, the 



natural arising single qubit rotations are Rz and Rx for both of them, and we can write 

U = Rz{a) Rx{e) Rz{P) . (4.84) 



Using the Z-X decomposition (4.84), a decomposition of the gate U can be obtained as 

r2 



% (a) R, (9) R, {13) ) [Rz (a) R^ {9) R, (/3) 

= Rz (a) Rx {9) Rz (a + (3) R^ {9) Rz 
= Rz{a + ui) Rx{u2) Rz{P + U3) 

for ui , V2 and fs such that 

Rx {9) Rz (a + /?) Rx {9) = Rz {vi) Rx (z^s) Rz {i^z) 



Solving the equation (4.86) gives us 



1^2 



2 arcsin ( sin 9 cos 



2 ( TT — arcsin ( sin 9 cos ^^y^^ ^ 



if (*) or (**), 
otherwise, 



(*) sin(a + /3) = and cos6'>0, 
(**) cos(9sin(a + /3) > , 



a + /3 1^2 

ui = arcsin I sm cos — 

'22 



1/3 =1/1. 



(4.85) 



(4.86) 



(4.87) 



(4.88) 
(4.89) 



Analogically, a decomposition of the gate C/^ is easily calculated in the following loop: 

repeat k times: 

calculate 1^2 
calculate vi 
a <^ a + vi 
6* ^ 1/2 

[3 <= 13 + VI 



(4.90) 



return U 



Rz (a) Rx (9) Rz (/3) . 



Knowing the angles a, 9, f3 corresponding to the single qubit gate U"^ , we can implement 



(Theorem 3.3.1) its controlled version with a circuit 



- C B A - 
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where 



A = R, (a) {6/2) (-^/2) , 

B = R, (7r/2) R, (-6/2) R,{-{a + P + tt)/2) 

C = R,{{p-a + 7r)/2). 



(4.91) 



This construction can be pretty much simphfied for the operator ( |4.81 ). See the circuit in 
the Figure 4.19, Essentiahy, the circuit exploits the identity XRz{a)X = Rz{—a). 



e^" 



R,{2''a (mod 27r)) Rz{-2^a (mod 27r)) 



Figure 4.19: Controlled powers of the simple Z-rotation operator. 
Now, the question is how to implement the ControUed-NOT gate. The XX coupling term in 



the Hamiltonian (4.82) produces during time t an unitary evolution described by a matrix 



( H ^2 \ 

il i2 

i2 il 

V ^2 ii J 



where ti = cos7t, ^2 = — ^sin7t . (4.92) 



Hadamard rotations modify (4.92) to the diagonal form 

{H <S) H) e-*T(^®^)* {H®H)= diag(e-^^*, e'^\ e'^\ e"^^*) , (4.93) 
and additional single qubit gates lead (after simplification) to the ControUed-NOT implemen- 



tation shown in the Figure 4.20 



i?,(7r/2) 




i?,(7r/2) 








i?,(7r/2) 




i?,(7r/2) - 


- i?.(7r/2) 
























Rx{^/2) 




- Rzi.^) - 






- Rz{^) - 




- i?x(7r) 





Figure 4.20: Controlled-NOT implementation using the XX coupling; = Sir/ 4. 
A complete minimized gate sequence implementing the A;-th step of the iterative phase es- 



timation (Figure 4.16) applied to the operator (4.81) is shown in the Figure 4.21 After 
m iterations (measurements), we obtain an m-bit estimate of a phase (j) = a/27r with high 
probability. 

For simulations of a real experiment, we used a noise model with accurate initialization and 
measurement, but imperfect gates. The unitary operation of the i-th gate can be parameter- 
ized as a rotation of a certain angle ifi around some axis (X, Z or XX). The angle is a product 
of the tunable strength of the corresponding control or interaction term in the Hamiltonian Aj 
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0) - i?^(2'=-i« (mod 27r)) - R^{ttI2) 



■ _R^(2*-ia (mod 2tt)) - Rx{Tr/2) 



. |0> 



Figure 4.21: The k-th step of the IPEA apphed to the operator (4.81), implemented on a 
two-qubit system with XX coupling. Note the block structure. 



and time ti the interaction is switched on, ipi = Xiti. Assuming a precise timing, a fluctuating 
interaction/control strength 

Ai X, + 6x, (4.94) 



leads to fluctuations in the rotation angle 



V^i 1 + 



The fluctuations are assumed to be evenly distributed in the interval 

A 6x- A 

< — < — 

2 A, 2 ' 



(4.95) 



(4.96) 



where A is a dimensionless parameter, indicating the strength of the noise. As an example, 
for A = 1 a 7r/2 X-rotation will be replaced with an X- rotation with a random angle, evenly 
distributed between tt/4 and 37r/4. 

The success probability of the circuit as a function of the noise level A is shown in the 



Figure 4.22a 
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(a) The success probability of the IPEA correctly 
determining m — 10 binary digits of the phase 
(j) = a/2iT, as a function of the noise level A. The 
curves shows errors in all Z, X, XX-coupling gates 
separately, as well as in all gates simultaneously. 
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Figure 4.22: Results of simulations of the circuit shown in the Figure 4.21 



As can be seen the setup is quite robust towards errors up to A ~ 0.3 and the Rz gates are 
the most sensitive gates. When the noise level is larger, repeated measurements on individual 
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bits are necessary. To achieve an overall success probability of 1 — e, we need to increase 
the per bit success probability to (1 — e/m), using Nk trials (repeated measurements). The 
number Ni^ can be determined in the following way. We write down the estimates obtained 
from few sample runs of the circuit. From these results it is possible to calculate per bit 
success probabilities P^. Next, we set the desired per bit success probability to P^ = 1 — e/m 



and Nk can be calculated using the equation (4.75) (see Page 75). Essentially, A^'^ can be 



read out from the plot of the function (4.75). A convenient way is to express this cumulative 



distribution function in terms of the regularized incomplete beta function 

E (^')iPk)'''-'i^-Pj^r = betainc(p.,^,^) for iV, = 1, 3, 5, . . . 

(4.97) 

in order to avoid numerical problems with a huge binomial coefficient, and calculate N^ using 
the following Matlab® 6 compatible code: 

function nreps = NRepetitions (pO, perr) 

nreps is the number of trials needed to determine a bit with 
°/o perr probability of error if 
7o pO is the single shot success rate 

nreps = ceil(f zero(@(x) myfun(x,pO,perr) , [1 1000000])); 

function f = myfun (x, pO, perr) 

f = betainc (1-pO, (x+l)/2, (x+l)/2) - perr; 



Figure 4.22b shows the total number of measurements needed to obtain the phase (j) = a/27r 
with m accurate bits under different noise levels and an error probability e < 0.05. As 
one can see, repeated bitwise measurements works well up to rather high noise levels. The 
total number of measurements scales as 0(m log(l/e)). However, above a certain noise level, 
when the external noise dominates over the intrinsic errors arising from the remainder 5 (see 



Page 73), the error probability per bit becomes almost independent of the bit position k. 
Besides other problems, the feedback improvement does not work any more. Then N/. on 
average is proportional to log(l/efc) = log(m/e) and total number of measurements scales as 
0(mlog(m/e)) with a relatively large hidden constant. 

The circuit shown in the Figure |4.21 can be also rearranged using the ZZ-coupling. The 



results of the simulations are very similar. However, the rearranged circuit does not have the 
nice block structure which might be useful in a real experimental setup. 



Simulations with focus on the coupling term 



The construction used to implement controlled powers of the operator (4.81) shown in the 
Figure 4.19 is not the only possible construction given the underlying Hamiltonians (4.82) 

-n(z^z)t _ diag(e-^^*, e^^*, e^^*, e''^^) 



and (4.83). Unitary gates 
and XX{-ft) 



-i-y{X(S,X)t 



(4.98) 
(4.99) 
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arising from the ZZ and XX coupling terms, respectively, can be used straightforwardly to 
achieve the same goal without intermediate construction of the two controUed-NOT gates. 



Figure 4.23a shows a complete minimized circuit implementing the k-th step of the IPEA 



applied to the operator (4.81), exploiting the ZZ-coupling directly. A circuit making use of 



the XX-coupling is shown in the Figure 4.23b 



i?,(7r/2) 



ZZ (5a2'=-i (mod 2tt)) 



|o> 



(a) Construction utilizing directly the ZZ-coupling. 



i?,(7r/2) - R,{-tt/2) 



XX {\a2^^^ (mod 2tt)) 



(b) Construction utilizing directly the XX-coupling. 



Figure 4.23: The fc-th step of the IPEA applied to the operator (4.811, implemented on a 
two-qubit system. Implementation makes direct use of the coupling terms in the Hamiltonians 
(14821) and (Osl). 



In the simulations of a real experiment under the noise model described in the previous section. 



both circuits performed almost identically. Figure 4.24a shows the success probability as a 



function of the noise level A for a circuit with the ZZ-coupling. 




0.5 1 
noise level (A) 

(a) The success probability of the IPEA correctly 
determining m — 10 binary digits of the phase 
(j> = a/2TT, as a function of the noise level A. The 
curves shows errors in all Z, X, ZZ-coupling gates 
separately, as well as in all gates simultaneously. 
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(b) The total number of measurements as a func- 
tion of the number of bits m and noise level A. 
The noise level A is the same for all gates. 



Figure 4.24: Results of simulations of the circuit shown in the Figure 4.23a 



The success probability is somewhat better compared to the result shown in the Figure 4.22a 
and as expected the coupling gate is the most sensitive gate. Importantly, the feedback gate 
Rz{ook) is quite robust compared to the other gates. The total number of measurements 
needed to obtain the phase with m accurate bits under different noise levels and an error 
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probability e < 0.05 is then shown in the Figure 4.24b These results are very much the same 



as results shown in the Figure 4.22b 



Simulations of a setup close to the Abrams-Lloyd algorithm 

The two previous setups represented simple test-bed applications (benchmarks) where an 
input parameter a is plugged in as ~ (2^a (mod 27r)) in each iteration of the IPEA and the 
obtained outcome < (p >■ is expected to exhibit strong correlations with a, < (p >■ = a/27r. 
A different (stronger) benchmark can be performed within a scenario where the coupling 
strength 7 is supposed to be unknown and the goal of the IPEA is to estimate 7. 



Let us consider a circuit shown in the Figure 4.25 The ZZ gate is parameterized similarly 



as in the Figure 4.23a but since the parameter a is not known now, the modulo operation is 
not present any more. 



|0) - ] R^{tt/2) ^ 
|0) 



ZZ{{a/2)2 



|o) 



Figure 4.25: The k-th step of the IPEA applied to the operator (4.81 ), implemented on a two- 



qubit system using the entangling ZZ gate. The parameter a is considered to be unknown. 
The circuit estimates the coupling strength 7 of the ZZ gate. 



The elementary entangling gate in this circuit is the ZZ{a/2) gate and it describes an unitary 
evolution g-«7(^®-^)* produced during a time interval t, typically order of nanoseconds. As 
follows from the definition of the ZZ gate (Eq. 4.98), a = 2^t (mod 27r). Since the outcome 
of the IPEA is an estimate of the value 



a/27r, an estimate of 7 is then equal to 



7 ► 



vr < 



t 



(4.100) 



In the view of the fact that 7 is unknown, the only possibility how to implement the powers 
of the ZZ{a/2) gate, as required by the steps of the IPEA, is to create a long sequences 
of applications of the plain ZZ{a/2) gate. This is equivalent to an evolution during a time 
interval (2^~^t) : 



{ZZia/2)Y 



ZZ[{a/2)2 



(4.101) 



In the simulations of this setup while considering superconducting qubits, it is necessary to 
take into account the effect of pure dephasing in the computational basis with rate F^ as 
a result of the environmental noise and long time intervals {2^~^ t) |94| [95] . Dephasing is a 
process in which a physical qubit without any error corrections is losing its phase information. 
In our setup, the accuracy of the ZZ{{a/2)2''~^) gate will be affected with a dephasing 
rate proportional to T^p/'j. In addition, it is considered imperfect X-rotations of the form 
i?2,-(±7r/2 + Sx), where 5x is a normally distributed random angle with variance Ax. Errors in 
the Rz{ujk) gate are omitted, since as compared to errors in other gates, they do not contribute 



to the decrease of the success probability too significantly, see Figure 4.23a 
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The success probability of the circuit as a function of dephasing rate T,^/^ and variance A^; 
is shown for m = 5 and m = 7 in the Figure 4.26a The circuit is rather robust against 



X-rotation errors, while being much more sensitive to dephasing. 
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(a) The success probability of the IPEA to cor- 
rectly determine the phase = a/27r, with preci- 
sion better than (upper/green line) and 2"^^ 
(lower/blue line) as a function of the noise level. 
The three cases of pure X-gate errors, pure de- 
phasing, and both types of noise acting simulta- 
neously are considered. The simulation was aver- 
aged over evenly distributed a. 
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(b) The total number of measurements needed to 
obtain the phase — a/2n with precision better 
than 2~™ (2 < m < 11), with error probability e < 
0.05. 



Figure 4.26: Results of simulations of the circuit shown in the Figure 4.25 



In order understand this sensitivity, an analytical expression was carried out. The per bit 
success probability without errors as derived in the Section 4.3.2 is 

1 



Pfc = cos2(^2^-i(52-™)) = =- (l + cos(7r2'=(<52 



The errors modify (4.102) into 



l + e-^'-H2'=(r./7) cos(7r2'^(52- 



(4.102) 



(4.103) 



It is evident that the factor 2'^ brought by dephasing into the exponent of (4.103) is respon- 
sible for the circuit's increased sensitivity to the environmental noise. As in the previous 
simulations, the success probability can be improved by repeated measurements of each bit. 
The number of per bit repetitions N^ is proportional to exp(2^ (rt^/7)) , to neutralize the 



4.26b 



shows the total number of 



effect of the 'noise term' exp(— A^. — |q:| 2'^(r<^/7)). Figure 
measurements needed to obtain the phase (j) with m accurate bits under different noise levels 
and an error probability e < 0.05. For a realistic dephasing rate 0.01 < T^p/j < 0.1 [93], 
between 5 and 8 binary digits of cp can be extracted with less than 10^ measurements. 
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4.4.2 Multiround protocols for reference frame alignment 

The IPEA has been so far presented as a viable alternative to the QFT-based PEA in situa- 
tions where the number of available qubits is a crucial limiting factor. Besides, the IPEA and 
other iterative variants for phase estimation can also be useful in communication tasks. In 
communication between two parties, a common frame of reference is usually needed. This is 
not less true for quantum communication where e.g. to encode information into the horizontal 
or vertical polarization of a photon, we have to agree on the spatial direction of these axes. 
Think of ground to satellite quantum cryptography [96^ . While some quantum information 
processing tasks can be achieved completely without a shared reference frame by using en- 
tangled states of multiple systems |67| EI] , this is not true in general, and a shared reference 
frame is always a valuable resource. The question is how to align (share) a reference frame 
in the most efficient way, optimally at the Heisenberg limit. 

Protocols for reference frame alignment which do not require transmission of large entan- 
gled states have been studied by Rudolph and Grover [97 , and de Burgh and Bartlett [98] . 
This is of importance since large entangled states are difficult to be communicated faithfully. 
Essentially, the protocols which have been discovered are instances of the Kitaev phase es- 
timation procedure. Due to its iterative (multiround) nature, these protocols are referred 
to as multiround protocols. Protocols utilizing the QFT-based PEA are called single round 
protocols. 

Phase reference alignment 

Phase reference alignment corresponds to the problem of synchronizing distant clocks. There 
are two classical approaches to distant clock synchronization. The Einstein light-pulse syn- 
chronization protocol and the Eddington adiabatic clock transfer scheme. Einstein synchro- 
nization uses a light pulse sent between the clocks, in order to estimate the transmission time. 
In the Eddington scheme, a wristwatch synchronized to the first clock is sent to the place of 
the second clock. 

Entanglement enhanced versions of both protocols have been suggested |99| 1100] , as well 
as a new protocol for clock synchronization based on shared prior entanglement |101j . In 
the quantum version of the Eddington protocol |100] , the crucial idea is to encode the time 
difference into the relative phase of physical systems (qubits) having a well-defined energy 
difference, so called 'ticking' qubits. Then the QFT-based PEA is used to estimate this phase. 

Burgh and Bartlett [98] pointed out that the protocol |100| is, however, using quantum 
operations in such a way that the two parties would need an a priori shared phase reference 
(e.g. synchronized clocks), just to be able to agree on the operations. The multiround 
protocol of Burgh and Bartlett (BB) solves this problem and additionally does not require 
entanglement. The framework for the BB protocol is as follows. 

Let us assume that Alice and Bob share an inertial reference frame (relativistic effect can be 
neglected) and agree on a free Hamiltonian of two level atomic ticking qubit 



This means they can agree on the upper and lower energy eigenstates and the frequency 
standard lo. States |0) and |1) can also be understood as defining a common shared Z axis 




(4.104) 
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of the Bloch sphere that describes the two dimensional qubit (atomic) Hilbert space. The 
shared Z axis viewed as a resource is enough for Ahce and Bob to agree on a qubit state 



cos 6*10) + e*^ sin 6*11 



(4.105) 



up to the phase ^. They would need a shared phase reference to agree on a qubit state 
completely. Let us assume that both Alice and Bob define their local phase reference relatively 
to their clocks that are ticking at the same frequency u. The time difference of their clocks is 
given by At = t\B — t\A (Bob's clock is ahead). Then for example, a state described by Alice 
as IV')^ = ^(|0) + |1)) corresponds to the state = (|0) + e*('^'^*)|l)) in Bob's frame. 

The state of the ticking qubit evolving under the free Hamiltonian TCuck can be pictured as the 
Bloch vector rotating anticlockwise about the Z axis, however, it is more convenient to work 
in the rotating frame in which the qubit no longer ticks. In this rotating frame, it is assumed 
that Alice and Bob use the Rabi pulses to interact with the qubit. The Rabi Hamiltonian is 
defined as 



T~(-Rabi{ct) = —{X COS a + Y s'ma) 



(4.106) 



where a is the phase angle of the laser, defined relatively to the local clock. The Rabi pulse 
applied for time t = P/fl corresponds to a unitary operator 



R,{a)R,{(5) R,{-a) 



(4.107) 



Using the operator U{a, (3) both parties, Alice and Bob, can relatively to their clock implement 
arbitrary single qubit gates. For example, the NOT gate X = C/(0,7r), the Hadamard gate 
H = XC/(7r/2,7r/2), and the vr/S gate T = H U{0,it/4) H . It follows that an operation 
U{a\B,(3) = UB{a\B) performed by Bob corresponds to the operation UA{a\A — (p) performed 
by Alice, where (j) = i^At; 



B) 



UA{a\A 



R,{-4>)UA{a\A) Rz{(t>) 



(4.108) 



The relation of operations Ua and Ub as described by the equation (4.108) can be translated 



into the language of the Bloch sphere as shown in the Figure 4.27 Alice and Bob share the 
Z axis, but their respective X-axes Xa and Xb do differ by an unknown angle (p = wAt. The 
problem of clock synchronization is hereby reduced to estimating the angle (j). 




Figure 4.27: Alice and Bob share the Z axis. However, their X-axes differ by an unknown 
angle (p. Working in the rotating frame simplifies this picture by being static and not rotating 
anticlockwise about the Z axis with the angular frequency w. 



The question is now how to encode an angle ~ {2^ct)) into the relative phase of a qubit to 
enable the phase estimation procedure. The BB protocol uses a clever phase amplifying 
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technique known from the Grover search algorithm [lUI H] which can be graphically viewed 
as mirroring a qubit state about the Xa and Xb axes. Let \iI^)a = cos^jO) + e*^sin^|l) be a 
qubit state described in the Alice's phase reference frame. The result of mirroring the state 



)a about the Xb axis and then about the Xa axis is shown in the Figure 4.28 




mirroring about 
the Xb axis 




mirroring about 
the Xa axis 




Figure 4.28: Grover phase amplification method graphically viewed as a mirroring technique. 



In practice, this mirroring effect can be achieved by a qubit exchange between Alice and Bob. 
Alice prepares a state \iIj)a ^-nd sends the qubit to Bob, Bob applies his NOT gate Xb, sends 
the qubit back, and Alice applies her NOT gate Xa- The net gain of this exchange expressed 
in Alice's phase reference frame is that a relative phase of the qubit is increased by an angle 

XaXb^a = Xa (R,{-(l))XARz{(t>)) = Rz{2ct))\^p) a ■ (4.109) 



It is now easy to see that XaXb Ha\0)a = :^(|0) + e'^^'^^|l))yi and the phase (j) can be 



estimated using the Kitaev phase estimation applied to the operator {Xa Xb), see Figure 4.29 
This is the BB protocol for phase reference alignment. 



|0)a 
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{XaXbY 



Ha 



Xk 



Figure 4.29: The Burgh and Bartlett protocol for phase reference alignment. 



Utilizing the IPEA derived in the Section 4.3.2, the scaling of the BB protocol can be im- 
proved. In order to do so, Alice only needs to modify the scheme by inserting the Rz{ijJk) 



feedback. Given the Rabi Hamiltonian (4.106), the Rz{uJk) gate can be implemented by a 



sequence of pulses producing {Ha Ua{0, oJk) Ha)- The IPEA applied to the operator {Xa Xb) 



is shown in the Figure 4.30 
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Figure 4.30: Improved protocol for phase reference alignment. 
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Spatial axes alignment 



The problem of establishing either a single direction in space or an orthogonal trihedron (xyz 
axes) using quantum enhanced methods was studied extensively in the past, see |97] for a list 
of references. A particular multiround protocol making no use of entanglement is discussed 
by Rudolph and Grover in [97^. The framework for the RG protocol is as follows. 

Let us assume that Alice and Bob define their spatial axes relatively to their single qubit 
rotations axes. Additionally, let the rotation matrix describing the change from Alice's to 
Bob's frame of reference be given by 

/ cos - -e*'^sin - \ 
i? = i?,(Oi?,(0)i?.(<^) = e-^(«+^)/M I l). (4.110) 

V -e*?sin| e'^+«cosf / 

The goal is to estimate the Euler angles 4>, 9, ^. 

Rudolph and Grover showed explicitly that the k-th bit describing the angle 9 (Kitaev-like 
approach) can be determined by applying the transform 

ok-i ( cos(2'=-i6') -e''*' s\n{2^-^9) \ 
y e *'^sm(2'' ^9) cos(2'' ^9) J 

to a qubit prepared in the state 1-0) _b = |0). The state \tp) b is expressed in the Bob's reference 
frame. The protocol goes as follows. Bob prepares the state \iP)b and sends the qubit to 
Alice, Alice applies her Z^ gate, sends the qubit back, and Bob applies his Zb gate. The 
qubit exchange is repeated 2^~^ times and then Bob performs the measurement to estimate 
the bit Xfc. The outcome '0' is observed with probability 



cos{2^-^9) 



^ = cos2(2^-^0) (4.112) 



and the outcome '1' with probability 

2 



Pi 



e~^'^sin(2'=-i^ 



s\n^{2^-^9) . (4.113) 



The other angle ^ oi (p needed to align the spatial axes can be estimated by changing the 
transform that Alice and Bob perform and/or the initial state Bob prepares. The important 
point is that it is possible to make the outcome probabilities dependent only on a specific 
angle at time. Intriguingly, in the light of the IPEA, it is not clear how to improve the scaling 
of the RG protocol by using a feedback. That is to find a unitary transform V{LOk) such that 
the outcome probabilities remain dependent only on 9 and oj^, for example. In fact, I was not 
able to find such transform, nor to rigorously prove that it does not exist. One open direction 
I keep working on is to focus on the order of angles to be estimated. 



4.5. QUANTUM PHASE ESTIMATION CONTUSIONS 
4.5 Quantum phase estimation conlusions 
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In this chapter, I discussed the broad issue of quantum phase estimation algorithm as a 
practical approach for problem solving on a quantum computer. Alternatively, it is possible 
to use the framework of quantum Fourier sampling. An example of a problem which is more 
naturally understood using the quantum Fourier sampling is the Shor factoring algorithm 
|12] . On the other side of the problem spectrum is the Abrams-Lloyd algorithm [81] which is 
rather well described using the phase estimation. 

In contrast to the modern quantum phase estimation based on the Fourier transform, the 
original Kitaev PEA [54j did not explicitly use the quantum Fourier transform and Kitaev's 
approach looked completely different from Shor's. However, soon it was recognized that the 
Kitaev's approach can be explained in terms of the Fourier transform over and that a 
transform over Z2" would be in fact more appropriate. Hence Kitaev's approach was unified 
with Shor's QFT approach for factoring and the QFT-based PEA was born Ul [7^ . While 
this is perfectly fine on the big scale of understanding the power of a quantum computer, a 
few interesting aspects of the original Kitaev work faded out. 

Guzik et. al. [85j building on the work of Abrams and Lloyd even carried out their own 
iterative phase estimation procedure in order to reduce the number of required qubits at time. 
Paradoxically, the Kitaev's circuit would require less resources under given circumstances and 
it is more robust to the environmental noise. When I started working on the phase estimation 
algorithm, my task was to investigate how to implement an instance of the Abrams-Lloyd 
PEA on three or less qubits. The stepping stones were the QFT-based PEA and the work 
of Guzik et. al.. As a first step, I rediscovered the Kitaev's circuit by reducing gates in the 
Guzik PEA to absolute minimum. Hereupon, I focused on the exigent classical postprocessing 
and incorporated it to the quantum circuit. Later, the validity of the obtained IPEA was 
verified using the adaptive measurement in the Fourier basis |86) (semiclassical QFT). 

The QFT-based PEA was implemented experimentally a few times |1021 1103] on three qubits 
and two-bit phase estimates were obtained. Using a benchmark circuit of similar complexity, 
I showed that a much higher precision can be achieved using the IPEA instead. 



In the Section 4.3.3 differences between the QFT-based PEA and the IPEA were discussed. 
Using the IPEA, repetitions needed due to the environmental noise and/or a high success 
probability require less resources compared to the QFT-based PEA. Next, in the context of 
the Abrams-Lloyd algorithm, the IPEA allows to exchange a long coherence time of an input 
eigenstate for a per iteration input state preparation. On the other hand, the QFT-based 
PEA enables to employ entangled ancilla input states which can be optimized with respect 
to a given cost function. 

The question of yielding optimal estimates with respect to the fidelity cost function without 
using entanglement was discussed a lot in multiround protocols for reference frame alignment 
[571 198] . It was concluded that presented protocols do not produce such optimal estimates. 
An existence of better protocols was left as an open problem. It should be clear from this 
thesis that the proposed protocols could not produce desired optimal estimates, since they use 
the Kitaev circuit which has a small logarithmic penalty compared to the IPEA. Moreover, an 
exact simulation of information flow in the QFT-based PEA cannot be achieved using small 
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fixed-size ancilla registers present in iterative schemes. Now, an open problem is to which 
degree entangled ancilla input states can be approximated in the IPEA. 



Chapter 5 

Quantum cryptography 



Special properties of quantum physical systems such as the no-cloning property of an unknown 
quantum state and the randomness of a wave function collapse allow for many quantum 
enhanced cryptographic primitives. These primitives range from authentication, secret key 
generation/distribution to covered communication (steganography) and more. Up to date, 
the BB84 protocol [104 and its variants [105] 1106] for quantum key generation are the most 
celebrated quantum cryptography primitives. 

For myself, I am particularly interested in quantum steganography and its applications re- 
lated to watermarking protocols for authentication. Similarly to the classical steganography, 
hidden communication is achieved via embedding a message into a redundant part of a (in- 
nocent looking) cover medium. The main difficulties for a steganographer are to identify 
the redundant part of the cover medium and insert a message in an unobtrusive way. For 
watermarking, it is additionally desirable for the message to be tied with the cover medium 
so well that the message cannot be removed by a third party without damaging the cover 
medium substantially. 

Embedding methods may differ to a large extent in the medium access level. The main levels 
are (1) physical carrier level, (2) error correction code level, and (3) data formats and protocol 
level. Steganography at the physical carrier level is somewhat specific in the sense that the 
theory of information coding does not play a big role, but instead it is a clear race in the 
technology available to the steganographer and steganalyst. To put it more to the context, 
let us take a look at the first commercially available products for quantum key generation 
|107| 1108] . For these devices to work as securely as proposed by the theory, single photon 
emitters and detectors are crucial. Nevertheless, single photon sources are often substituted 
with an industry-standard weak coherent pulse approach. Whilst practical, this approach 
suffers from non-zero probability of multiple-photons events. Apart from the introduced 
security loophole |109| 1110] , these extra photons can be, in priciple, used for steganographic 
purposes while legitimate quantum key generation seems to happen. 

Regarding quantum steganography on the error correction level, first steps along this line 
were accomplished by J. Gea-Banacloche in [111]. It was proposed to encode the message to 
be hidden into the error syndrome. Compared to the classical counterpart, quantum error 
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correction codes (QECC) are very suitable for steganographic purposes. This is due to the 
fact that quantum errors are continuous and quantum gates are very faulty, and therefore 
QECC schemes require a rather big bunch of extra physical qubits to create and preserve 
logical qubits. Especially, at higher levels of concatenated QECC |112] . it is plausible to 
assume that errors occur not too often, and the capacity of the QECC scheme can serve as a 
steganographic channel. 



An example of simple QECC scheme is shown in the Figure 5.1 Gea-Banacloche used the 
same scheme to present his ideas. 
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Figure 5.1: A circuit to decode the error syndrome of the 3-qubit repetition code and correct 
the error accordingly. Note that the correction part does not require measurement on the 
ancilla qubits a and b. 



The state 



a|000) +/3|111) = a\OL) + 



represents a logical qubit protected against a single bit flip error on any of the three physical 
qubits, using the 3-qubit repetition code [UHlll]. After the decoding & correction stage, the 
state of the ancilla qubits a and b holds the information on what had happened 

|00)afe : no error occurred, 

\10) ab '■ bit flip error X^^^ on the first physical qubit, 

ab '■ bit flip error X^"^^ on the second physical qubit, 

|01)afe : bit flip error X^^^ on the third physical qubit. 

Now, assuming that no accidental error will happen, it may be the steganographer who 
deliberately introduces an error and herewith transfers two bits of information. A convenient 
method for introducing an error (inserting a message) is to use the decoding & correction 
block in a reversed mode, see Figure |5.2[ 
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Figure 5.2: Quantum steganography on the error correction level. 



This steganographic channel can be also used for a simple authentication. Alice and Bob a 
priori agree on a special message (a tag). Then later, when Alice sends a state \tp) to Bob, 
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Bob considers the received state as authentic only if the embedded message corresponds to 
the agreed tag. Additionahy, it is required that a third party (with an access to a transmission 
channel) should not be able to change the state without affecting the tag as well. It was 
shown that this requirement can be fulfilled only if the tag is a quantum superposition of the 
form 

L\00)ab + K\01)ab + f^\10)ab + l^\ll)ab 

and not a classical digital tag, e.g. '10'. Effectively, the operation (decoding & correction 
block)"^ encodes the coefficients i, k, fi, v together with the coefficients a, /? in such a way that 
the transmitted state \'^) becomes encrypted and it is impossible for a third party to modify 
a,/3 without affecting the tag. In fact, the tag becomes a watermark. 

These results indicate that quantum authentication implies encryption and that it is impossi- 
ble to use digital signing to authenticate quantum states. Indeed, this was proven by Barnum 
et. al. [114_ in a more general study on authentication of quantum states. A limit case study 
addressing authentication of a single qubit using a shared quantum key of minimum length 
has been conducted by Curty et. al. |115] . Particular details of this study are discussed in 
the Section 15.11 

Finally, we discuss quantum steganography at the level of data formats and protocols. In 
digital data formats, tens of methods are known that exploit redundancy in JPEG images 
|116j . MP3 music files |117j . binary executable files fll8j and so on. However, there are no 
such formats in the quantum domain by this time. It is too early to predict how and when 
will the technology reach this stage. Nevertheless, some general methods such as modifying 
the least significant bits can be ported to the quantum domain quite easily |119] . 

Let us assume that a classical information, e.g. bits representing a picture, is going to be 
transmitted using qubits (a quantum channel). Each bit is mapped in some standard way to 
a qubit state. Additionally, since the carried information is a classical information and the 
mapping is publicly known, anybody with an access to the quantum channel can make copies 
of the qubits and check what is being transmitted. 

Under this scenario, Alice and Bob want to establish a steganographic channel. It is enough 
for them to merely agree on a non-standard base encoding and measurement on the qubits 
which corresponds to the least significant bits. Hereby they set up a secret channel. Other 
parties who are not aware of this deal treat all qubits in a standard way. As a consequence, 
these parties may obtain wrong bit values upon measurement, but due to the low significance 
of corresponding bits it can hardly be detected. Additionally, once the qubit carrying hidden 
information is collapsed by a measurement, no later leakage of the stego key (the deal of Alice 
and Bob) enables to obtain the past hidden information. There is no classical analogue of this 
pretty striking property. Of course, the difficult part for the steganographer is to properly 
identify which bits are the least significant ones. A variant of the above described method 
has been successfully used by K. Martin |120] to establish a steganographic channel within 
the BB84 protocol. Arbitrary third party sees only that a legitimate quantum key generation 
takes place. 

Regarding quantum steganography with entanglement, it is possible to build on schemes 
which are based on the superdense coding [12] . Basically, Alice and Bob start with a shared 
entangled pair of qubits. Then, (1) Alice applies a local unitary operation to her qubit, (2) 
Alice sends the qubit to Bob, (3) Bob performs joint measurement on both qubits, and (4) 
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the result represents a delivered two-bit message. A third party having an access to the sent 
off qubit while in traffic cannot get even a single bit of that message. 

5.1 Qubit authentication with a quantum key of minimum 
length 

Curty et. al. [115. studied the question whether a single qubit can be authenticated with 
a quantum key of minimum length. It was shown that, unlike in the case of quantum- 
authenticated classical bit value |121j . this is not possible. Nevertheless, it is interesting to 
see how the protocol works since all what is ultimately needed to make the protocol operating 
securely is to increase the length of the key [122 . 

The protocol |115] is as follows. Alice wants to send a general quantum state (possibly a mixed 
state) described by the density operator pu acting on a two-dimensional message space M. 
As in a classical authentication, a tag must be attached to the message, in order to allow to 
Bob to convince himself about the authenticity of the message. Let the tag be given by a 
density operator pj acting on a two dimensional tag space T. In principle, the tag can be 
larger, however, this is advantageous only in a presence of noise. No extra security is added. 
The tag space T has to be divided into two orthogonal subspaces. One subspace represents 
a valid tag, while the other represents an invalid tag. Without loss of generality, the state 
Pj =|0)(0| can be fixed as a valid tag. 

The space of tagged messages is then defined as e = M T and the tagged message is given 
by Pe = Pm ® Pj- On the space e a unitary coding set {/e,C/e} is defined, where is the 
identity operation and a unitary transformation. A shared quantum key has the form of 
a maximally entangled EPR pair, e.g. \ip)ab = ;^(l'-*l) ~ |10))- Alice and Bob each own one 
qubit of that EPR pair. The key can be publicly known as well as the coding set. The state 
of the global system (key -|- tagged message) is given by 

Pabe = \tp){tp\ab Pe = IV^XV^Iafc O PM O PT • (5.1) 

Encoding stage. Alice wants to send an authenticated message to Bob. In order to do so, 
Alice performs an encoding operation Eae which acts on her part of the key and the tagged 
message. With respect to the coding set {/e, Ue}, the encoding operation is defined as 

Eae=\0){0\a^lb^le + \l){l\a ^ h ^ U, . (5.2) 

Once the encoding operation is applied, Alice sends the encoded tagged message to Bob. The 
state of the global system after the encoding operation is given by 

p2: = Ea,PabeEl (5.3) 

= ^ (|01)(01| ®pe - |01)(10| - |10)(01| ?7ePe + \10){10\ U,p,ul^ . 

Decoding stage. Bob receives the encoded tagged message and decodes it using a decoding 
operation 

A. = /a®|0)(0|b®C/t + /,®|l)(l|b®/,. (5.4) 
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The state of the global system after the decoding is described as 



dec _ T-) enc T-)t 
Pabe — ^be Pabe '^he 



(5.5) 



]- f|01)(01| p,-|01)(10| (/)eC/l)f/.-|10)(01| [/t(C/,p,)+|10)(10| ® Ul{U,p,Ul)U, 



ab® Pe- 



Verification. Bob takes decoded tagged message, which is formally given by pf^'^ = trab(/3j^|^), 
and measures the tag portion. If the outcome belongs to a valid tag subspace of space T, 
then the extracted message is considered to be authentic. Using the gate model, the protocol 



can be depicted as shown in the Figure 5.3 



Pm 



PT 



shared quantum key 

|^)a.= ^(|01)-|10)) 



transmission 
channel 



X 



X 



be 



Alice 



Bob 



Figure 5.3: A protocol for qubit authentication with a quantum key of minimum length. 



Message attack 

Let us now consider a 'message attack' performed by an adversary party called Eve. This 
party with a full access to a public transmission channel sees a mixed state 

pf = iTab(pX) (5.6) 

= ^ (pm^|0)(0|t + C/.(pM®|0)(0|T)f/l 

Her task is to find a transformation Qe which, applied to pf', will modify the pu keeping the 
tag portion intact. The authors of | 115J gave an existential proof that such a transformation 
always exists regardless of the choice of C/^, thus the protocol is not secure. However, the 
form of Q^; with respect to and the range possible damages was not discussed. In a later 
paper |122j . it was shown that if the key is longer, then there exists a larger coding set such 
that Eve's desired Qe does not exists. 

An interesting point is what exactly happens when the operation is a separable gate. 
Classically, the tag must be a function of both the key and the message. Now, since the 



mixed state (5.6) is achievable even if Alice and Bob had shared only a classical one bit key, 
this indicates that [/^ should be an entangling gate to limit Eve's actions, at least. However, 
the shared key is a quantum one and the question is whether entanglement present in the key 
can compensate for non-entangling operation f/g. 
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Let Ue be a separable gate of the form U^ = Um (SiUj, then 

Pf = l (pm®|0)(0|t + {UmPmUI) <S) (?7T|0)(0|T?7j)) . (5.7) 
For Qe = I, where Q^; G e, i? € M and / G T, we have 

= QEpfQ^E (5-8) 
= ^(^RpMR^m{0\T + {R{UMPMUl)R^)^(UT\0){0\TU\^y 
And after Bob's decoding operation we get 

pQE4ec =^(^Rp^ iit^|o)(o|T + (uIrUm Pm Ul i?t ^7^^ ^ Uj \0){0\j [/| f/j)) 

(5.9) 

and trM (p^^''^'^^) =|0)(0|t. 

Hence the adversary party is always able to change the message pM keeping the tag portion 
intact, and there are no constraints on the operation R. Having some statistics of usually 
sent messages, R can be even optimized to cause maximal damage. This result also implies 
that there is no added security in the protocol by using quantum key instead of a classical 
key. 



Secret-key discussion 



Authenticating quantum data makes sense only in a scenario where a reliable technology for 
quantum information processing is available. This means that there are no extra costs in using 
quantum keys instead of classical ones. Moreover, quantum keys have better key-management 
properties thanks to the no-cloning theorem, and, strikingly, in the above described protocol 
the EPR pair does not collapse so it can be in principle reused. 

But anyway, reliable storing of an EPR pair requires a periodic entanglement purification 
|40] . In between two successive refreshments the EPR pair should be inevitably considered as 
corrupted to some degree. A well designed protocol has to be insensitive to a small corruption 
(entanglement purification guarantees to output only almost pure states), and a non- negligible 
corruption should result in a high probability of rejecting received messages as authentic ones. 

Let us correlate the corruption of the EPR pair with the quantity p of a maximally mixed 
state in the mixture. The state of the quantum key is then described by a density operator 

Pl = {i-p)\mu + p^-f- (5-10) 

When the protocol is executed with this mixed key the resulting global state of the system is 
described as 

pir, = Dte (Sae (/^ ® PM®|0)(0|t) 4,) > (^-H) 

and the decoded message after tracing out the key is 

p'r = tr,. {pH^) (5.12) 

= ^(PM®|0)(0|t) + ^(^l(pM®|0)(0|T)f/e + f/e(pM®|0)(0|T)C/l) . 
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Here, we can see that the probabihty of pf^'^ passing Bob's verification procedure is unpleas- 
antly high even for apparently corrupted key. Therefore, in this protocol and its variants a 
classical key should be preferred. 
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Chapter 6 

Conclusions 



In this thesis, I have addressed the emerging field of quantum computing. Since at the time 
of starting my PhD studies I was a complete newcomer to the field, a relatively large part of 
the thesis deals with portions of linear algebra essential to understanding the framework of 
quantum mechanics, and with comparison of deterministic, probabilistic and quantum Turing 
machines in order to emphasize the fundamental differences. The quantum gate model and the 
thin borderline between quantum evolutionary universal sets of gates and not even classically 
universal sets of gates are discussed as well. At this point, the thesis hopefully provides a self 
contained description of the main issues related to quantum computing. 

The major part of the thesis concerns the quantum phase estimation algorithm. This algo- 
rithm presents a fundamental approach for problem solving on a quantum computer and it 
can be used to well explain most of known quantum algorithms which yield an exponential 
speed-up compared to their classical counterparts. The two most prominent quantum algo- 
rithms are the Shor factoring algorithm and the Abrams-Lloyd algorithm for finding energy 
eigenvalues. In Section 4.2.5, it was shown how to cast both algorithms as a phase estimation 
problem and it was stressed why both algorithms are efficient with respect to the input size 
of the problem. 

The novel work I did encompasses a new simple proof of the lower bound of the PEA success 
probability, a derivation of an iterative scheme for quantum phase estimation (IPEA) from 
the Kitaev phase estimation, a study of robustness of the IPEA utilized as a few-qubit testbed 
application and an improved protocol for phase reference alignment. There is also a chapter 
concerning quantum steganography and authentication which provides additional insights into 
quantum enhanced protocols, however, no substantial contribution in this field is presented. 

The design and study of robustness of small testbed applications currently represents one 
of the chief goals in the quantum computing field. The famous theorem for fault-tolerant 
quantum computation uses a very general noise model and it is not clear at all whether the 
theorem actually holds in an experimental setting. Testbed applications provide an important 
way how to realize the potential of many-body quantum systems as quantum computers and 
give understanding to the effects of environmental noise. It might happen that our universe is 
not generous enough to allow for robust large-scale quantum computing, however, quantum 
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information processing plays an eminent role in forthcoming quantum sensors and similar 
nanoscale single purpose devices. Think of the energy transfer in plants during photosynthesis 

m- 

Regarding future work, it is planned to work out a complete example of a quantum chemistry 
calculation (the Abrams-Lloyd algorithm). That is to choose a small quantum system such as 
the Helium atom, map a corresponding truncated Hamiltonian to the states of two to three 
qubits, simulate the evolution, adiabatically prepare an approximate ground state and utilize 
the IPEA to estimate the ground state energy. 
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